Repository navigation
Confine worker writes to worktree + main-tree tripwire - #160
Merged
Merged
Conversation
Part A - confinement gate (execute_command refuses before spawn): - cd-escape guard: cd outside the workspace root is refused, since every later relative path would resolve outside the workspace - write-operand policy: cp/mv/touch/git -C/... operands resolving outside the workspace root are refused (shared ordered walk with chain-export overlay, poisoned vars fail closed) - documented non-goals: sudo/su/ssh/xargs -exec/script contents Part B - main-tree tripwire (fails loudly on escapes): - scripts/check-main-tree-clean.sh snapshots the main checkout before the run and diffs after; new entries (minus .worktrees/ and plans/parallel-tasks/) land in .harness.main-tree-dirty / .qa.main-tree-dirty plus loud log lines. All diagnostics go to stderr (stdout stays clean for wrapper-PID capture). - run-worker.sh (all 3 wrappers) + run-qa.sh wire snapshot/check. - watch.ts inspectGroup + status.ts reconcileGroups persist the finding as main_tree_dirty; status output shows a MAIN-TREE-DIRTY bit. cleanup.ts removes the new markers. Tests: 12 new main-tree-tripwire tests; 7 new permission-gate tests plus executor confinement test. Full suite 266 files green; tsc clean; check-standards and check-architecture clean (arch baseline regen is scoped: +2 clone keys, 3 x2->x3 membership updates for the new test file, 1 fixed complexity finding dropped). Closes #136.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #136.
Two halves, per the issue's suggestion (cwd guard / write-path policy in execute_command, failing loudly on escapes):
Part A — confinement gate.
execute_commandrefuses before spawn when the command would leave the workspace root:cdoutside the root (every later relative path would resolve outside), and write operands (cp/mv/touch/git -C/...) resolving outside the root. Shared ordered sub-command walk with chain-export overlay; poisoned variables fail closed;cd ""stays allowed (runtime no-op). Documented non-goals: sudo/su/ssh/xargs -exec/script contents — the tripwire below is the backstop.Part B — main-tree tripwire.
scripts/check-main-tree-clean.shsnapshots the main checkout before the run and diffs right after the worker exits; new entries (minus the orchestrator-owned.worktrees/andplans/parallel-tasks/) are recorded in.harness.main-tree-dirty/.qa.main-tree-dirtyplus loud log lines. Wired into all threerun-worker.shwrappers andrun-qa.sh, before the.donemarker. All diagnostics go to stderr (stdout stays clean for wrapper-PID capture).inspectGroup+reconcileGroupspersist the finding asmain_tree_dirty; status output shows aMAIN-TREE-DIRTYbit; cleanup removes the new markers. The marker is evidence for review, not an auto-fail (concurrent operator edits in the window match too).Verification: 12 new tripwire tests + 7 gate tests + executor confinement test, full suite 266 files green, tsc clean, check-standards and check-architecture clean. Arch baseline regen is scoped (+2 clone keys, 3 x2→x3 membership updates, 1 fixed complexity finding dropped).
Follow-ups (not this PR): #138 owns the shared test-runner helper (this PR adds one more conventional test-main);
src/permissions/commands.tsis overdue for a file split.