coilyco-flight-deck/cli-guard

Fork 0

sandbox: leak-free placement for the .<tool>.cliguard exec symlink #185

New issue

Closed

opened 2026-07-03 20:00:47 +00:00 by coilyco-ops · 2 comments

coilyco-ops commented

2026-07-03 20:00:47 +00:00

Member

Follow-up to 8886aee (closes ward#546). installToolShim now drops a .<tool>.cliguard symlink beside the canonical entry (e.g. next to brew) and execs that, so a $0-sensitive tool resolves the correct install prefix. It works, but the symlink is written to the real canonical dir inside the jail namespace and persists on the host - it is idempotently reused, so not a correctness issue, but it is a small on-host artifact leak.

Worth a leak-free placement: an overlay/tmpfs mount over the canonical dir, or another mechanism that keeps the exec symlink inside the sandbox and off the host filesystem. Noted in the commit body as a known follow-up.

Follow-up to 8886aee (closes ward#546). installToolShim now drops a `.<tool>.cliguard` symlink beside the canonical entry (e.g. next to brew) and execs that, so a $0-sensitive tool resolves the correct install prefix. It works, but the symlink is written to the real canonical dir inside the jail namespace and **persists on the host** - it is idempotently reused, so not a correctness issue, but it is a small on-host artifact leak. Worth a leak-free placement: an overlay/tmpfs mount over the canonical dir, or another mechanism that keeps the exec symlink inside the sandbox and off the host filesystem. Noted in the commit body as a known follow-up.

coilyco-ops added the

label

2026-07-04 17:37:36 +00:00

coilyco-ops added the

interactive

label

2026-07-07 04:07:58 +00:00

coilyco-ops added

headless

and removed

interactive

labels

2026-07-10 08:59:46 +00:00

coilyco-ops added the

interactive

label

2026-07-10 11:57:48 +00:00

coilyco-ops removed the

interactive

label

2026-07-14 07:49:54 +00:00

coilyco-ops commented

2026-07-14 08:53:03 +00:00

Author

Member

WARDED_WORKFLOW: reservation-held

reservation details

Holder: launch intent for container engineer-codex-cli-guard-185 on host kais-macbook-pro-2.local.

Accepted by ward agent --harness codex (reserved 2026-07-14T08:53:02Z). Concurrent ward agent runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). --override-reservation overrides.

Do not comment on or edit this issue to steer the run while it is reserved. The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a new issue, dispatched fresh. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494).

run seed context — what this run is carrying (ward#609)

Resolved: coilyco-flight-deck/cli-guard#185 · branch issue-185 · harness codex · workflow pull-request-and-merge
Run: engineer-codex-cli-guard-185 · ward v0.672.0 · dispatched 2026-07-14T08:53:00Z
Comment thread: 0 included in the pre-flight read, 0 stripped (ward's own automated comments).

Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0).

— Codex, via ward agent

WARDED_WORKFLOW: reservation-held <details><summary>reservation details</summary> Holder: launch intent for container `engineer-codex-cli-guard-185` on host `kais-macbook-pro-2.local`. Accepted by `ward agent --harness codex` (reserved 2026-07-14T08:53:02Z). Concurrent `ward agent` runs are blocked until this intent becomes visible or the intent is released. The stale-intent fallback is still TTL-bounded (3h TTL). `--override-reservation` overrides. **Do not comment on or edit this issue to steer the run while it is reserved.** The engineer seeded the body once at launch and never re-reads it, so a comment or edit reaches only human readers, never the running engineer. A correction goes to a **new issue, dispatched fresh**. That is the only channel that reaches a run in flight. Where the forge supports it, ward locks this conversation to make that a road-block rather than a convention (ward#494). <details><summary>run seed context — what this run is carrying (ward#609)</summary> - **Resolved:** `coilyco-flight-deck/cli-guard#185` · branch `issue-185` · harness `codex` · workflow `pull-request-and-merge` - **Run:** `engineer-codex-cli-guard-185` · ward `v0.672.0` · dispatched `2026-07-14T08:53:00Z` - **Comment thread:** 0 included in the pre-flight read, 0 stripped (ward's own automated comments). Static container doctrine and seed boilerplate are identical every run and omitted here (they ride ward v0.672.0). </details> </details>  — Codex, via `ward agent`

coilyco-ops referenced this issue from a commit

2026-07-14 09:05:58 +00:00

sandbox: keep exec symlink off host filesystem

coilyco-ops referenced this issue from a pull request that will close it,

2026-07-14 09:06:16 +00:00

sandbox: leak-free placement for the .cliguard exec symlink #227

coilysiren closed this issue

2026-07-14 09:29:40 +00:00

coilyco-ops commented

2026-07-14 09:30:34 +00:00

Author

Member

WARDED_WORKFLOW: #227

details

workflow: pull-request-and-merge; review summary: skipped because review gate skipped by ~/.ward/config.yaml default

Implementation felt like a narrow refactor after the lint feedback. Confidence: high. Surprise: CI failure was gocognit/unparam, not the sandbox leak work. Follow-ups: none.

WARDED_WORKFLOW: https://forgejo.coilysiren.me/coilyco-flight-deck/cli-guard/pulls/227 <details><summary>details</summary> workflow: pull-request-and-merge; review summary: skipped because review gate skipped by ~/.ward/config.yaml default Implementation felt like a narrow refactor after the lint feedback. Confidence: high. Surprise: CI failure was gocognit/unparam, not the sandbox leak work. Follow-ups: none. </details>