sandbox: leak-free placement for the .cliguard exec symlink #227

Merged

coilysiren merged 5 commits from issue-185-sandbox-leakfree into main 2026-07-14 09:29:40 +00:00

Conversation 0 Commits 5 Files changed 5 +224 -45

coilyco-ops commented 2026-07-14 09:06:16 +00:00

Member

Copy link

This keeps the sandbox's $0-sensitive exec symlink inside a private tmpfs view of the canonical tool directory, so the helper can still exec .<tool>.cliguard without leaving a host-side artifact.

• What changed: pre-resolve wrapped tools, stash real binaries first, overlay the canonical tool dir with a private tmpfs, and place the exec symlink there.
• Why: the old path worked but left .<tool>.cliguard behind on the host.
• Tests: go test -vet=off -p 1 ./cli/sandbox ./cli/shell; full make test hit container scratch-space limits in this environment.

closes #185
ward.workflow: pull-request-and-merge

This keeps the sandbox's `$0`-sensitive exec symlink inside a private tmpfs view of the canonical tool directory, so the helper can still exec `.<tool>.cliguard` without leaving a host-side artifact. - What changed: pre-resolve wrapped tools, stash real binaries first, overlay the canonical tool dir with a private tmpfs, and place the exec symlink there. - Why: the old path worked but left `.<tool>.cliguard` behind on the host. - Tests: `go test -vet=off -p 1 ./cli/sandbox ./cli/shell`; full `make test` hit container scratch-space limits in this environment. closes #185 ward.workflow: pull-request-and-merge

coilyco-ops added 1 commit 2026-07-14 09:06:16 +00:00

sandbox: keep exec symlink off host filesystem ... d4bb2a1062

closes #185

coilyco-ops added 1 commit 2026-07-14 09:11:21 +00:00

ci: route Go scratch to runner temp ... d13a169c9a

Use runner.temp for Go build, module, and golangci-lint caches so the CI jobs do not fill the container overlay during typecheck.

coilyco-ops added 1 commit 2026-07-14 09:12:31 +00:00

ci: export Go scratch through runner env ... d1057cd33f

Configure Go build, module, and golangci-lint scratch through GITHUB_ENV so Forgejo and GitHub runners can use the runner temp volume without relying on unsupported job-level expressions.

coilyco-ops added 1 commit 2026-07-14 09:19:37 +00:00

ci: tame golangci-lint scratch use f64e4cc35e

coilyco-ops added 1 commit 2026-07-14 09:24:52 +00:00

sandbox: reduce jail setup complexity ... 97a01ccfba

Signed-off-by: Codex <noreply@openai.com>

coilysiren merged commit b28749551c into main 2026-07-14 09:29:40 +00:00

coilysiren referenced this pull request from a commit 2026-07-14 09:29:41 +00:00

Merge pull request 'sandbox: leak-free placement for the .cliguard exec symlink' (#227) from issue-185-sandbox-leakfree into main

coilyco-ops referenced this pull request 2026-07-14 09:30:34 +00:00

sandbox: leak-free placement for the .<tool>.cliguard exec symlink #185

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

burndown-2026-06

Backlog burndown June 2026

  

sunday-sprint

Burn-down by Sunday 2026-06-07

  

coherence-core

Core review set for the warded control plane coherence milestone. These issues form the release spine; adjacent milestone issues are stretch or supporting work.

  

consult

A human decision, design, or external action must happen first. Fail-closed default for unlabeled/low-confidence.

  

headless

Agent can take it from open issue to merged change with no human in the loop. The auto-burndown queue.

  

interactive

Agent does the work but pauses at a human checkpoint mid-flight (design choice, destructive step, human-only verification).

  

P0

now / blocking / urgent

  

P1

next / important

  

P2

backlog / will do

  

P3

someday / low

  

P4

icebox / frozen / reopen if it becomes real

No labels

burndown-2026-06

sunday-sprint

coherence-core

consult

headless

interactive

P0

P1

P2

P3

P4

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-flight-deck/cli-guard!227

No description provided.