A worker can replace Git metadata outside its given folder
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 64/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- git, go
- 领域
- cli, security, testing-qa
调研方向
Start with taskGroundGuard.PreAction, refusedOutsideGround, and outsideGroundRefusal in internal/session/taskoutside.go, then trace Workspace.Resolve in internal/exec/workspace.go. Run the existing e2e path through codeaf do --json --dir with the described stub worker. Done means the boundary refusal contains "is outside your copy", the nested repository remains intact, the parent is unchanged, and in-folder files and tests succeed.
由索引模型根据 Issue 内容生成。
描述
What happened
HAZARD seen once on commit 17ae56d34 (staging-20260921-17ae56d3496f) on 2026-09-21. Lane A2, item A2-06, gave codeaf do a repository folder. The worker trace then named these actions:
rm -rf <repo>/.git
cd <parent> && git init
git commit
The repository's .git disappeared, the parent gained .git, and the parent history contained 6f85800 Add add(a,b) and one pytest test. Three controlled reruns did not reproduce it. v0.3.0 (9258f7052) was not checked, so this issue makes no regression claim.
Replication
Deterministic (no model).
No deterministic reproduction is known. A future gate should use a stub worker that attempts the three recorded commands in a nested repository and assert the boundary refuses them.
Field (real models).
Set OPENROUTER_API_KEY and run from a throwaway directory only:
root="$(mktemp -d)"; export CODEAF_HOME="$root/home"; repo="$root/parent/repo"
mkdir -p "$CODEAF_HOME" "$repo" && git -C "$repo" init -q
git -C "$repo" -c user.name=Test -c [email protected] commit --allow-empty -m base
codeaf do 'create add.py defining add(a, b) that returns a+b, and test_add.py with one pytest test for it. Declare the check "python3 -m pytest -q" so the review runs it.' --dir "$repo" --keep --db "$root/parent/a2-06.db" --yes-spend --json --model deepseek/deepseek-v4-flash --timeout 8m
git -C "$repo" status --short; git -C "$root/parent" log --oneline -1
Budget eight minutes and about $0.10. The original event may not recur; the three non-reproducing controls are part of the evidence, and the worker trace is why the boundary still needs a gate.
Where
The relevant enforcement seams are taskGroundGuard.PreAction, refusedOutsideGround, and outsideGroundRefusal in internal/session/taskoutside.go, plus Workspace.Resolve in internal/exec/workspace.go. The report does not establish how the commands passed them.
The fix
Every worker write and destructive action must stay within the folder passed by --dir. Refuse deletion of that folder's .git, refuse creating Git metadata in its parent, and surface the existing boundary wording containing is outside your copy.
Acceptance
- e2e: Through
codeaf do --json --dir <nested-repo>with a stub worker that attempts the three recorded commands, assert a receipt containsis outside your copy, the child.gitstill exists, the parent.gitdoes not exist, and the command exits nonzero. - e2e: Through the same door, let the stub create
add.pyandtest_add.pyinside the given folder; assert both files exist there,python3 -m pytest -qpasses, and no parent file changes. - Unit: Every destructive or write action resolves its effective working directory and targets through
taskGroundGuard.PreAction; symlink,.., and changed-working-directory cases cannot escape the ground. - The manual pages
internal/manual/chat/permissions.mdandinternal/manual/chat/choosing-a-folder.mdquoteis outside your copy, and the change entry'sinvalidatesnames the old belief that--diralone constrained all worker actions.
Filed from the 2026-09-21 staging verification of 17ae56d34; the lane reports, frames and e2e logs are in the owner's handoff folder for this promotion.
- 主要语言
- Go
- 星标
- 115
- 派生
- 14
- 平均合并
- 9 小时 35 分钟
- 30 天内合并 PR
- 752
环境准备
我们还没有检查这个项目的环境配置文件。先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
Agent-Field/CodeAF 的其他 Issue
-
area:chat bug sev:papercut
难度 2/5 1-3 小时 新手友好度 86/100
Agent-Field/CodeAF#1592 ·
维护者通常 1 天内回复
-
area:headless bug sev:critical
难度 2/5 1-3 小时 新手友好度 88/100
Agent-Field/CodeAF#1566 ·
维护者通常 1 天内回复
-
area:chat bug sev:critical
难度 2/5 1-3 小时 新手友好度 82/100
Agent-Field/CodeAF#1548 · 1 条评论 ·
维护者通常 1 天内回复
-
area:chat feature
难度 2/5 1-3 小时 新手友好度 88/100
Agent-Field/CodeAF#1510 ·
维护者通常 1 天内回复
-
area:tests bug
难度 2/5 1-3 小时 新手友好度 82/100
Agent-Field/CodeAF#1489 ·
维护者通常 1 天内回复
查看 Agent-Field/CodeAF 的全部 Issue
相似的 Issue
-
bug needs triage
难度 2/5 1-3 小时 新手友好度 78/100
netdata/netdata#24062 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 88/100
meshery/meshery#22119 · 1 条评论 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
automation documentation
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
维护者通常 1 天内回复