ai-sandbox: encrypt snapshot blobs at rest with an encrypting blob store wrapper

オープン
  • 何か問題がありますか？
#2,062 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@AlemTuzlak がすでに取り組んでいます。

2026年11月5日 から。

評価

この issue はまだ評価されていません。

説明

waiting-on: maintainer

Add an encrypting wrapper for snapshot blob stores in @tanstack/ai-sandbox, so that snapshot files are encrypted at rest with one option:

const snapshots = createSandboxSnapshots({
  persistence: withEncryptedBlobs(persistence, { key }),
  checkpoints,
})

Why

A sandbox snapshot can hold secrets. In #1982, sandboxComputer({ snapshots }) saves a Chromium profile, and the profile holds the session cookies of every site that the agent signed in to. A person with the cookies can use those accounts.

Today the docs only say "keep the blob store secret, and encrypt it in production" (docs/computer-use/drivers.md). Each user must write their own encryption. That is easy to get wrong.

How it fits

  • The snapshot code writes each file to stores.blobs at sandbox-files/sha256/<hash of the plain bytes>.
  • On restore, it reads the blob and checks the hash of the bytes (packages/ai-sandbox/src/snapshots.ts).
  • So a wrapper can encrypt in put and decrypt in get. The keys and the hash check do not change.

Work

  1. Add withEncryptedBlobs(persistence, { key }). It returns the same persistence with a wrapped stores.blobs.
  2. Use AES-GCM from Web Crypto, with a new random IV for each blob. Store the IV with the ciphertext. Run in Node, Workers, and browsers.
  3. Accept a CryptoKey, or a function that returns one, so the key can come from a KMS. Add a key id to the blob metadata, for key rotation.
  4. Make get work for every body type and for range. A range read must decrypt the whole blob, then slice it. size and etag describe the ciphertext.
  5. Fail with a clear error when a blob cannot be decrypted (wrong key, changed data). Do not return the ciphertext.
  6. Update docs/computer-use/drivers.md and the snapshot docs. Use the wrapper in examples/react/computer-use-login.

Open questions

  • The blob key holds the SHA-256 of the plain file. A person who can list the store can check if a known file is in a snapshot. Is that acceptable, or does the snapshot code need keyed hashes (HMAC) when encryption is on?
  • Other metadata stays plain: file paths, sizes, and the checkpoint records. List this in the docs.

Context

  • #1982: computer use sign-in example with profile snapshots.
  • #1108: portable file snapshots.
主要言語
TypeScript
スター
3.3k
フォーク
378
平均マージ
1日 2時間
マージ済み PR（30日）
254

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

TanStack/ai のほかの issue

TanStack/ai の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。