sandbox: scope built-in agent profile per runtime; narrow ~/.local read#129
Merged
Conversation
- h5i env rm <name> [--force]: permanently remove an env — prune worktree, delete code + reasoning branches, erase on-disk manifest, and strip the manifest/policy lines from refs/h5i/env so a re-materialize can't resurrect it (only the append-only 'removed' event survives). --force for a live env. - h5i recall objects/search --env <name>: filter evidence captures by the env that produced them (full id / <agent>/<slug> / bare slug; via objects::env_id_matches). - h5i env context <name>: alias for 'context show' on the env reasoning branch. Tests: unit (env_id_matches, search env filter, remove_jsonl_by_id) + integration (rm lifecycle, recall --env scoping incl. removed envs, env context).
Koukyosyumei
changed the title
Collaborator
Author
|
Caution 🚨 BLOCK MERGE — 3 credential leaks detectedRotate the exposed secrets and remove them from history before merging. The h5i audit found 3 findings in this branch's diff. Full details in the table below. Caution 3 credential leaks across 1 commit — rotate the exposed secrets before merging.
🪙 16% AI-authored · 5 files
Important 🎯 Goal: split built-in agent sandbox profile by runtime (claude vs codex) for fs+egress least-privilege; narrow ~/.local read grant
💬 The ask
📍 What shipped
Warning Duplicate code introduced in 5 files — consider extracting a helper before this lands.
🧠 Reasoning by file — 4481 nodes across 6 lanes, latest 24 only%%{init: {"flowchart": {"nodeSpacing": 42, "rankSpacing": 48, "diagramPadding": 14}, "themeVariables": {"fontSize": "18px"}} }%%
flowchart TB
subgraph lane_0["💭 Reasoning · 4 steps"]
direction LR
n_lane_0_0["THINK · Let me view what follows the env-code push to add the remote head-branch…"]:::t
n_lane_0_1["NOTE · PLACEHOLDER (~/Dev/h5i/src/main.rs): Now replace the whole push block (6…"]:::n
n_lane_0_2["THINK · Let me quickly confirm the earlier feature commit is still in history (t…"]:::t
n_lane_0_3["NOTE · DEFERRAL (~/Dev/h5i/src/main.rs): box` with a clean working tree. As a r…"]:::n
n_lane_0_0 --> n_lane_0_1
n_lane_0_1 --> n_lane_0_2
n_lane_0_2 --> n_lane_0_3
end
subgraph lane_1["📄 src/main.rs · 6 ops"]
direction LR
n_lane_1_0["READ"]:::o
n_lane_1_1["EDIT"]:::a
n_lane_1_2["READ"]:::o
n_lane_1_3["EDIT × 3"]:::a
n_lane_1_0 --> n_lane_1_1
n_lane_1_1 --> n_lane_1_2
n_lane_1_2 --> n_lane_1_3
end
subgraph lane_2["📄 tests/env_integration.rs · 6 ops"]
direction LR
n_lane_2_0["READ"]:::o
n_lane_2_1["EDIT"]:::a
n_lane_2_2["READ"]:::o
n_lane_2_3["EDIT × 3"]:::a
n_lane_2_0 --> n_lane_2_1
n_lane_2_1 --> n_lane_2_2
n_lane_2_2 --> n_lane_2_3
end
subgraph lane_3["📄 CLAUDE.md · 4 ops"]
direction LR
n_lane_3_0["EDIT × 4"]:::a
end
subgraph lane_4["📄 docs/environments-design.md · 2 ops"]
direction LR
n_lane_4_0["EDIT × 2"]:::a
end
subgraph lane_5["🗂 Other · 2 nodes"]
direction LR
n_lane_5_0["READ · read src/env.rs"]:::o
n_lane_5_1["EDIT · edited src/env.rs"]:::a
n_lane_5_0 --> n_lane_5_1
end
classDef o fill:#dbeafe,stroke:#1e3a8a,color:#0b1c4a;
classDef t fill:#fef3c7,stroke:#92400e,color:#3f2d05;
classDef a fill:#dcfce7,stroke:#166534,color:#0a2e16;
classDef n fill:#ede9fe,stroke:#5b21b6,color:#221251;
classDef m fill:#e5e7eb,stroke:#374151,color:#0b0f17;
📜 Per-commit provenance
|
The env code branch must be a real local branch (a git worktree needs one), but a remote like GitHub renders every refs/heads/* as a branch — so env sandboxes cluttered the branch list. Make it a transport remap: locally it stays refs/heads/h5i/env/<agent>/<slug>, but on the wire it travels under the hidden sibling namespace refs/h5i/env-code/* (pushable + fetchable yet absent from branch UIs, like GitHub's own refs/pull/*). - push: +refs/heads/h5i/env/*:refs/h5i/env-code/*, and delete any stray refs/heads/h5i/env/* left on the remote. - pull / setup-remote: fetch FF-only refs/h5i/env-code/*:refs/heads/h5i/env/*. The state ref stays the leaf refs/h5i/env: env-code is a SIBLING (not nested), so there is no ref-store file/dir collision and no migration is needed (tool has no released users to migrate).
Previously the env state ref (refs/h5i/env) and the code transport (refs/h5i/env-code/*) sat as two siblings, which read as two unrelated things. Tidy them under a single refs/h5i/env/ namespace: refs/h5i/env/meta # state: events + manifests + policies refs/h5i/env/code/<agent>/<slug> # code transport (hidden from branch UIs) The state ref is '…/meta' rather than the bare leaf 'refs/h5i/env' only because git's ref store cannot hold a leaf and a directory at the same path. No migration code (the tool has no released users); a one-time local+remote cleanup relocates an existing repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.