Tianyi Cui
41d3e78d3a
test(snapshots): require explicit delegation depth
2026-07-20 17:59:13 +08:00
kingwl
2530bf8aa3
fix(sandbox): address PR #309 review — TOCTOU direction, denial metadata, shared roots, docs
...
- fs-sandbox: delegate the mutation with the freshly re-canonicalized target
(not the stale one), so the checked identity is the mutated identity — a
symlink swapped in after resolve() can no longer escape workspace-write.
- tool-fs: map a denial to an FsError carrying FS_SANDBOX_DENIED (not a plain
Error), so ToolRegistry keeps the structured code on result.error for
retry/observers while the message stays the shared marker.
- sandbox-local: derive the Seatbelt writable set from the shared
writableRoots() helper, so the profile and the fs fence cannot drift.
- gen-doc-graphs: ctx.sandboxPolicy is owned by dsh-sandbox-policy and read only
by the sandboxed executor/provider (the tool layers use the pure fold).
- docs: bash-sandbox/bash/permission READMEs and bash.md reflect the relocated
policy home and the sandbox/mode rename; drop the stale stdout.golden.jsonl.
2026-07-20 13:59:18 +08:00
kingwl
2e7cdddb89
Merge remote-tracking branch 'origin/master' into cross-family-fs-sandbox
...
# Conflicts:
# .agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.i18n.yaml
# .agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.md
# .agents/notes/implemented/feature/2026-07-14-cross-family-fs-sandbox.zh.md
# docs/capability-seams.md
# docs/cordis-catalog/events.md
# docs/cordis-catalog/services.md
# docs/event-producer-consumer.md
# docs/module-graph.md
# docs/persistence-catalog.md
# docs/rfc/INDEX.md
# examples/acp-agent/README.md
# examples/acp-agent/fs.cordis.snapshot.yml
# examples/acp-agent/fs.cordis.yml
# examples/acp-agent/tests/snapshots/escalation-approved/session.jsonl
# examples/acp-agent/tests/snapshots/escalation-rejected/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-pretool-ask/session.jsonl
# examples/acp-agent/tests/snapshots/permission-switching/session.jsonl
# examples/acp-agent/tests/snapshots/workspace-context/system-prompt.expected.md
# examples/acp-agent/tests/snapshots/workspace-context/tool-schemas.expected.json
# examples/acp-agent/tests/snapshots/workspace-edit/system-prompt.expected.md
# examples/acp-agent/tests/snapshots/workspace-edit/tool-schemas.expected.json
# packages/bash/bash/src/index.ts
# packages/bash/tool-bash/package.json
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/cordis/tool-cordis/src/api-catalog.ts
# packages/fs/README.md
# packages/fs/tool-fs/src/edit.ts
# packages/fs/tool-fs/src/write.ts
# packages/sandbox/README.md
# pnpm-lock.yaml
2026-07-20 11:44:37 +08:00
kingwl
9a2ef4e229
Merge remote-tracking branch 'origin/master' into cross-family-fs-sandbox
...
# Conflicts:
# docs/config-catalog.md
# docs/cordis-catalog/services.md
# docs/module-graph.md
# docs/rfc/implemented/feature/2026-07-06-sandbox.md
# examples/acp-agent/tests/snapshots/advanced-toolchain/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/advanced-toolchain/tool-schemas.golden.json
# examples/acp-agent/tests/snapshots/both-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/both-mode-turn/tool-schemas.golden.json
# examples/acp-agent/tests/snapshots/code-mode-turn/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/escalation-approved/session.jsonl
# examples/acp-agent/tests/snapshots/escalation-rejected/session.jsonl
# examples/acp-agent/tests/snapshots/hook-cc-pretool-ask/session.jsonl
# examples/acp-agent/tests/snapshots/permission-switching/session.jsonl
# examples/acp-agent/tests/snapshots/permission-switching/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/permission-switching/tool-schemas.golden.json
# examples/acp-agent/tests/snapshots/skill-load/tool-schemas.golden.json
# examples/acp-agent/tests/snapshots/text-turn/tool-schemas.golden.json
# examples/acp-agent/tests/snapshots/workspace-edit/system-prompt.golden.md
# examples/acp-agent/tests/snapshots/workspace-edit/tool-schemas.golden.json
# packages/bash/bash-sandbox/src/index.ts
# packages/bash/bash-sandbox/tests/bwrap.e2e.ts
# packages/bash/bash-sandbox/tests/sandbox.spec.ts
# packages/bash/bash-sandbox/tests/seatbelt.e2e.ts
# packages/bash/bash/src/index.ts
# packages/bash/tool-bash/package.json
# packages/bash/tool-bash/src/index.ts
# packages/bash/tool-bash/src/render.ts
# packages/bash/tool-bash/tests/tools.spec.ts
# packages/bash/tool-bash/tsconfig.json
# pnpm-lock.yaml
# scripts/verify-package-readme-model-experience.ts
2026-07-16 23:32:17 +08:00
kingwl
d46d37f372
Merge remote-tracking branch 'origin/master' into cross-family-fs-sandbox
...
# Conflicts:
# docs/config-catalog.md
# docs/module-graph.md
# docs/rfc/INDEX.md
# examples/acp-agent/composition.md
# examples/acp-agent/cordis.yml
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.1.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.2.jsonl
# examples/acp-agent/tests/snapshots/advanced-toolchain/session.jsonl
# examples/acp-agent/tests/snapshots/both-mode-turn/session.jsonl
# examples/acp-agent/tests/snapshots/permission-switching/session.jsonl
# examples/acp-agent/tests/snapshots/skill-load/session.jsonl
# examples/acp-agent/tests/snapshots/text-turn/session.jsonl
# packages/bash/bash-sandbox/package.json
# packages/bash/bash/package.json
# packages/bash/tool-bash/src/index.ts
# packages/fs/fs/package.json
# packages/fs/tool-fs/package.json
# packages/fs/tool-fs/src/index.ts
# packages/fs/tool-fs/tests/tools.spec.ts
# pnpm-lock.yaml
2026-07-15 21:39:02 +08:00
kingwl
91247babd9
test(acp-agent): snapshot the fs sandbox escalation arc
...
A recorded scenario where the model writes a workspace file in one write call
with sandbox_permissions=danger-full-access + justification, the scripted
client allows once, and the escalated write lands — the fs twin of
escalation-approved, covering the fs escalation approval arc (only bash had a
snapshot before). Uses a new workspace-internal file to avoid the
read-before-edit detour, keeping the recorded path single and deterministic.
2026-07-15 00:17:29 +08:00
