Repository navigation
Conversation
Harness-Claim: true Agent: switchboard-dev Host: ANCHOR Base-Ref: origin/main Base-SHA: e0f144b Claimed-At: 2026-11-07T16:29:07.4833092Z Nonce: 1fc9b61a5593e7e6
The effective triggers directory is a host control surface, and later slices of #1022 let a trigger open and stop sessions. Protect it at every visible mount alias for all sandbox launches, and refuse a launch whose mounts would expose it. This does not hold when the Podman socket is exposed; docs/sandbox.md says so.
…hes every launch A project path with a newline launches again unless it overlaps the control tree; the changelog says which layouts are refused; launch tests follow new, resume, fork and schedule to the spawn; Linux-only wrapper cases stay skipped on Windows.
# Conflicts: # CHANGELOG.md # main.js
The cron sandbox cases point SWITCHBOARD_TRIGGERS_DIR at their temp root instead of creating ~/.switchboard/triggers/processed in the runner's home.
…writable mounts The wrapper mounts a fresh tmpfs on /tmp, so a control tree under the runner's TMP is covered by it and stays unexposed; the test only has to refuse a bind.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
First slice of #1022: the effective triggers directory becomes a protected host surface before any trigger can open or stop a session. Spec: issue comments, §1 and §6.
scripts/claude-sandbox.shprotects the control tree at every visible mount alias, pins ancestors, and refuses unsafe or missing paths and writable overlaps.trigger-watcher.jsexports the effective directory resolver;main.jspasses that path to manual and schedule sandbox launches.Not verified locally: this machine is Windows, so the wrapper's Linux cases and the real-bwrap fixture skip here. Ubuntu CI is the proof for them.
The
openandstopactions come in later slices.