Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Graduated guard with secure-exec sandbox tier and learning feedback loop

オープン
  • 何か問題がありますか？
#704 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

まだ誰も着手していません。

評価

難易度
5/5
見積もり時間
1週間以上
初心者へのやさしさ
25/100
issue の種類
機能追加
明瞭さ
明確に書かれている
活発さ
停滞
技術スタック
rust, shell, typescript
領域
security, tooling

調査の方向性

Read crates/terraphim_agent/src/guard_patterns.rs and plans/terraphim-secure-exec-convergence.md first, then evaluate whether secure-exec's child_process bridge enforces the proposed restrictions. Review the hook entry points in ~/.claude/hooks/pre_tool_use.sh and post_tool_use.sh. Done requires the feasibility gate and the phased three-tier guard, sandbox execution, learning, and review flow described in the issue.

索引モデルが issue の本文から書いたものです。

説明

enhancement

Summary

Extend the CommandGuard from binary allow/deny to a three-tier decision system (allow/sandbox/deny), integrate rivet-dev/secure-exec as the sandbox execution layer, and wire the PostToolUse learning capture into an adaptive pattern evolution loop.

Motivation

Today the PreToolUse guard has no middle ground: a command is either blocked entirely (destructive pattern match) or runs with full host access. Commands that are suspicious but not outright destructive (e.g., curl | sh, writes to ~/.ssh/, chmod 777, eval of dynamic strings) pass through unchecked.

The learning capture system records failures but does not feed back into the guard patterns. Guard patterns are static KG entries that only change via manual editing.

Proposed Design

Three convergence layers

Layer 1 -- Graduated Guard Decisions

  • Add GuardDecision::Sandbox to guard_patterns.rs alongside existing Allow and Block
  • Add a third pattern set: suspicious_patterns (between safe and destructive)
  • Create ~/.config/terraphim/kg/guard-suspicious/ directory with initial entries
  • The PreToolUse hook reads the three-valued decision and routes accordingly

Layer 2 -- Secure Exec as Sandbox Tier

  • When guard returns sandbox, run the command inside a V8 isolate via secure-exec
  • Permission profiles scoped by command type: read-only project dir, network deny-by-default, no process spawning, 64 MB memory cap, 10s CPU time limit
  • 17ms cold start makes this viable for interactive development
  • Thin wrapper script at ~/.claude/hooks/sandbox-exec.ts

Layer 3 -- Learning-Driven Pattern Evolution

  • Extend learn hook to capture sandbox outcomes (permission violations, timeouts, clean passes)
  • Promotion/demotion rules: 3+ clean sandbox runs suggests promotion to allow; permission violation promotes to deny
  • Auto-generate KG entries into guard-staging/ directory
  • Human review gate via terraphim-agent guard review before patterns become active
Architecture
Command arrives
    |
    v
Guard (Aho-Corasick pattern match)
    |
    +-- destructive match ---------> DENY (never runs)
    +-- suspicious match ----------> SANDBOX (V8 isolate via secure-exec)
    +-- KG-recognised safe match --> ALLOW (full host access)
    +-- unknown --------------------> SANDBOX (default-to-sandbox)
    |
    v
Replace (KG synonym substitution, runs regardless of tier)
    |
    v
Execute (tier-appropriate: raw shell or sandboxed)
    |
    v
Learn (capture outcome, feed back into guard patterns)
    |
    +-- repeated sandbox success --> promote to ALLOW
    +-- sandbox violation/failure -> promote to DENY
    +-- new pattern discovered ----> add to KG

Implementation Phases

  • Phase 0 (1 day): Evaluation spike -- verify secure-exec child_process bridge enforces filesystem restrictions inside V8 isolate. This is the critical gate for Layer 2.
  • Phase 1 (2 days): Add GuardDecision::Sandbox to guard_patterns.rs, create suspicious pattern KG entries, update pre_tool_use.sh
  • Phase 2 (3 days): Create sandbox-exec.ts wrapper, define permission profiles, wire into PreToolUse hook
  • Phase 3 (3 days): Extend learning capture for sandbox outcomes, build promotion/demotion engine, KG auto-generation with staging directory
  • Phase 4 (1 day): Integrate guard pattern review into daily sweep

Key Risk

Whether secure-exec's bridged child_process module enforces isolate-level filesystem restrictions on spawned shell commands. If not, Layer 2 applies only to AI-generated JS/TS code execution, not arbitrary shell commands. Layers 1 and 3 remain valuable regardless.

References

  • Design document: plans/terraphim-secure-exec-convergence.md in cto-executive-system
  • Secure Exec: https://github.com/rivet-dev/secure-exec (Apache-2.0, 17ms cold start, 3.4 MB memory)
  • Current guard implementation: crates/terraphim_agent/src/guard_patterns.rs
  • Current hook scripts: ~/.claude/hooks/pre_tool_use.sh, post_tool_use.sh
  • Related: secure-exec knowledge entry at knowledge/external/context-engineering/secure-exec-sandboxless-code-execution.md
主要言語
Rust
スター
64
フォーク
5
平均マージ
1時間 17分
マージ済み PR（30日）
2

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

terraphim/terraphim-ai のほかの issue

terraphim/terraphim-ai の issue をすべて見る

似ている issue

Rust の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。