Repository navigation
agent: confine the run tool's commands to the project folder #204
Description
The agent's run tool (sidecar/src/agent.ts) runs uv in the project folder with a small environment, a timeout, and a guard that ends the command when its sidecar ends. The command still runs as the person, so Python it runs can read or write any file the person can. The project-folder check covers only the file tools (read, write, edit) and pictures sent with a message.
CodeRabbit raised this on #200 (discussion_r4502787316). It is out of scope there, since #200 moves the agent loop into the sidecar without changing what a command may reach.
It also bears on three of CodeRabbit's declined findings on #200: the time between a path check and its open in the file tools and for pictures, and the operation receipts kept in the project's .m3d/ops. Once commands are confined, those become worth hardening. Today a command can already do anything they would allow.
A likely approach on macOS: run the guard under a Seatbelt profile (sandbox-exec) that allows reads of the system, the uv cache, and the Python toolchains, and allows writes only in the project folder and a temp folder. Check first that uv's downloads and the Bambu-free build scripts still work under it.
Activity
pullfrog commentedon Nov 7, 2026
No confirmed duplicate found. #192 concerns process cleanup, not filesystem confinement. This work builds on #200, where
sidecar/src/agent.tscurrently lives; it is not yet onmain.Implementation plan
run’senv.execboundary. Both the parent agent and Astra already share this tool, so keep one enforcement path. Preserve the guard, timeout, restricted environment, output logs, and durable replay behavior.HOME. Resolveuv, Python toolchain, and cache paths explicitly. Prefer a dedicated writable cache over making shared executable caches writable.uvdownloads and the Bambu-free build/check scripts before adopting the profile. Sandbox setup failures must return an actionable error rather than silently executing unrestricted. Make support on other platforms explicit..m3d/opsreceipt integrity as separate hardening work. A writable project still exposes its receipts; filesystem confinement alone does not make those trusted.The optional verification-doctrine lookup failed with
HTTP 404; no test execution or verification claims are made here. No code changed and no PR opened.gpt-6.1-sol｜ 𝕏