Yichen Jiang a90ccc4453
revert(sandbox): withdraw the credential-document read denial ...
The `readDenyPaths` policy field shipped in the previous commit broke Linux
confinement outright. bwrap has to create the `/dev/null` bind's mount point
inside a tree its own profile has already made read-only, so it refused the
entire confinement whenever the parent directory was absent — every host that
has not stored a credential yet, including a fresh install:
bwrap: Can't mkdir parents for /home/runner/.dsh/.env: Read-only file system
which the executor correctly classifies as SANDBOX_UNAVAILABLE, so every
confined bash call failed closed. Landlock cannot subtract from its own `/`
read grant, so it reported `partial` enforcement on every confined call for a
file it never hid, with no way to switch the denial off (schemastery fills an
omitted array with `[]`, so empty and omitted were indistinguishable).
A protection that breaks confinement where it works and misreports it where it
does not is worse than a documented absence. Revert the field, both expressible
backends, the enforcement downgrade, and the policy default; state the residue
plainly in the credentials-local READMEs — file mode stops other OS users, not
the model — and keep the OS-keychain provider recorded as the real answer.
The narrower discipline stands: no surface hoists the credential document into
`process.env`, and the model is never handed a resolved path to it.
2026-07-30 17:09:42 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-23 00:10:53 +08:00
2026-07-22 23:07:14 +08:00
2026-07-23 00:10:53 +08:00
2026-07-23 19:48:00 +08:00
2026-07-23 19:33:30 +08:00
2026-07-23 19:48:00 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-26 22:45:33 +08:00
2026-07-26 22:45:33 +08:00
2026-07-26 22:45:33 +08:00
2026-07-28 22:16:43 +08:00
2026-07-28 22:16:43 +08:00
2026-07-28 22:16:43 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 13:57:16 +08:00
2026-07-23 00:10:53 +08:00
2026-07-24 13:57:16 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 15:11:17 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-26 05:35:04 +08:00
2026-07-26 05:13:39 +08:00
2026-07-26 05:35:04 +08:00
2026-07-27 23:29:26 +08:00
2026-07-27 23:29:26 +08:00
2026-07-27 23:29:26 +08:00
2026-07-23 01:11:59 +08:00
2026-07-22 23:07:14 +08:00
2026-07-23 01:11:59 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-24 18:38:27 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 18:38:27 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-26 23:06:00 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-28 00:00:51 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-24 13:57:16 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 13:57:16 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 12:43:59 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-24 15:10:55 +08:00
2026-07-23 19:33:30 +08:00
2026-07-24 15:10:55 +08:00
2026-07-24 17:39:22 +08:00
2026-07-22 23:07:14 +08:00
2026-07-24 17:39:22 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-26 02:33:29 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-27 21:17:49 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 23:43:10 +08:00
2026-07-25 01:58:42 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-26 14:00:37 +08:00
2026-07-26 14:00:37 +08:00
2026-07-26 14:00:37 +08:00
2026-07-19 22:52:03 +08:00
2026-07-19 22:52:03 +08:00
2026-07-19 22:52:03 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-21 21:11:32 +08:00
2026-07-21 21:11:32 +08:00
2026-07-21 21:11:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-26 20:51:32 +08:00
2026-07-23 03:15:15 +08:00
2026-07-23 03:15:15 +08:00
2026-07-23 03:15:15 +08:00
2026-07-29 18:59:23 +08:00
2026-07-29 18:59:23 +08:00
2026-07-29 18:59:23 +08:00
2026-07-24 14:55:54 +08:00
2026-07-24 14:55:54 +08:00
2026-07-24 14:55:54 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 20:15:09 +08:00
2026-07-21 01:13:28 +08:00
2026-07-21 01:13:28 +08:00
2026-07-21 01:13:28 +08:00
2026-07-23 15:54:10 +08:00
2026-07-23 15:54:10 +08:00
2026-07-23 15:54:10 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 21:20:06 +08:00
2026-07-27 15:49:09 +08:00
2026-07-27 15:49:09 +08:00
2026-07-27 15:49:09 +08:00
2026-07-25 16:43:07 +08:00
2026-07-25 16:43:07 +08:00
2026-07-25 16:43:07 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-24 01:40:25 +08:00
2026-07-30 01:58:51 +08:00
2026-07-30 01:58:51 +08:00
2026-07-30 01:58:51 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-27 12:04:12 +08:00
2026-07-27 12:04:12 +08:00
2026-07-27 12:04:12 +08:00
2026-07-26 13:42:02 +08:00
2026-07-26 13:42:02 +08:00
2026-07-26 13:42:02 +08:00
2026-07-25 15:11:17 +08:00
2026-07-24 21:50:11 +08:00
2026-07-25 15:11:17 +08:00
2026-07-28 15:45:53 +08:00
2026-07-28 15:45:53 +08:00
2026-07-28 15:45:53 +08:00
2026-07-21 15:57:17 +08:00
2026-07-21 15:57:17 +08:00
2026-07-21 15:57:17 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-26 13:13:53 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-28 12:09:48 +08:00
2026-07-29 20:46:29 +08:00
2026-07-29 20:46:29 +08:00
2026-07-29 20:46:29 +08:00
2026-07-27 03:54:33 +08:00
2026-07-27 03:54:33 +08:00
2026-07-27 03:54:33 +08:00
2026-07-28 02:33:14 -07:00
2026-07-28 02:33:14 -07:00
2026-07-28 02:33:14 -07:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-27 04:14:51 +08:00
2026-07-26 12:17:45 +08:00
2026-07-26 12:17:45 +08:00
2026-07-26 12:17:45 +08:00
2026-07-29 23:45:42 +08:00
2026-07-29 23:45:42 +08:00
2026-07-29 23:45:42 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 03:52:41 +08:00
2026-07-27 21:04:11 +08:00
2026-07-27 21:04:11 +08:00
2026-07-27 21:04:11 +08:00
2026-07-28 17:02:39 +08:00
2026-07-28 17:02:39 +08:00
2026-07-28 17:02:39 +08:00
2026-07-29 10:30:27 +08:00
2026-07-29 10:30:27 +08:00
2026-07-29 10:30:27 +08:00
2026-07-29 05:32:53 +08:00
2026-07-29 05:32:53 +08:00
2026-07-29 05:32:53 +08:00
2026-07-29 13:15:24 +08:00
2026-07-29 13:15:24 +08:00
2026-07-29 13:15:24 +08:00
2026-07-30 01:14:25 +08:00
2026-07-30 01:14:25 +08:00
2026-07-28 22:30:12 +08:00
2026-07-28 13:55:59 +08:00
2026-07-28 13:55:59 +08:00
2026-07-28 13:55:59 +08:00
2026-07-30 14:09:04 +08:00
2026-07-30 14:09:04 +08:00
2026-07-30 14:09:04 +08:00
2026-07-29 13:15:24 +08:00
2026-07-29 13:15:24 +08:00
2026-07-29 13:15:24 +08:00
2026-07-30 16:37:28 +08:00
2026-07-30 16:11:21 +08:00
2026-07-30 16:37:28 +08:00
2026-07-30 17:09:42 +08:00
2026-07-30 17:09:42 +08:00
2026-07-30 17:09:42 +08:00
2026-07-30 14:09:04 +08:00
2026-07-30 14:09:04 +08:00
2026-07-30 14:09:04 +08:00
a90ccc4453