Skip to content

env: inject IS_SANDBOX=1 for agent-in-box profiles#146

Merged
Koukyosyumei merged 1 commit into
mainfrom
bypass-sudo-in-supervised-mode
Jun 16, 2026
Merged

env: inject IS_SANDBOX=1 for agent-in-box profiles#146
Koukyosyumei merged 1 commit into
mainfrom
bypass-sudo-in-supervised-mode

Conversation

@Koukyosyumei

Copy link
Copy Markdown
Collaborator

Agent profiles map the agent to root-in-userns on the egress tiers (nft needs CAP_NET_ADMIN across execve), so Claude Code's getuid()==0 guard refuses --dangerously-skip-permissions. Inject IS_SANDBOX=1 to skip only that root check -- the box still pins the agent to the real unprivileged host uid, so no real capability is granted. Scoped to agent profiles; caller/env.pass-supplied IS_SANDBOX wins.

Agent profiles map the agent to root-in-userns on the egress tiers (nft
needs CAP_NET_ADMIN across execve), so Claude Code's getuid()==0 guard
refuses --dangerously-skip-permissions. Inject IS_SANDBOX=1 to skip only
that root check -- the box still pins the agent to the real unprivileged
host uid, so no real capability is granted. Scoped to agent profiles;
caller/env.pass-supplied IS_SANDBOX wins.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
@Koukyosyumei

Copy link
Copy Markdown
Collaborator Author

🪙 100% AI-authored · 5 files

1 AI commit

1 / 151.1 : 11 / 4
AI commitsfiles touchedREAD : EDITTHINKs / ops

💬 The ask

"implement the IS_SANDBOX=1 injection for agent profiles and add a test"

📍 What shipped

  • ✓ env: inject IS_SANDBOX=1 for agent-in-box profiles

Tip

✅ Security scan clean

No credentials leaked in this branch's diff. h5i scanned every added line against the secret rule pack and found nothing to rotate.

Note

Duplicate-code scan clean — no copy-paste blocks introduced.

🧠 Reasoning by file — 6241 nodes across 6 lanes, latest 24 only
%%{init: {"flowchart": {"nodeSpacing": 42, "rankSpacing": 48, "diagramPadding": 14}, "themeVariables": {"fontSize": "18px"}} }%%
flowchart TB
  subgraph lane_0["💭 Reasoning · 7 steps"]
    direction LR
    n_lane_0_0["THINK · Since these are comment-only changes, let me run a quick `cargo check` t…"]:::t
    n_lane_0_1["NOTE · PLACEHOLDER (~/Dev/h5i/.git/.h5i/env/human/update-comments/work/src/toke…"]:::n
    n_lane_0_2["MERGE · merged 'env/human/update-comments' into 'improve-shell'"]:::m
    n_lane_0_3["THINK · Let me confirm the agent profile triggers the egress (uid-0) path and ch…"]:::t
    n_lane_0_4["THINK · Let me follow the project rules and check context, then explore the rele…"]:::t
    n_lane_0_5["THINK · I'll add a helper and apply it centrally in both dispatch functions."]:::t
    n_lane_0_6["NOTE · DEFERRAL: y. 2. **The `powerline-shell: Permission denied` line is a sep…"]:::n
    n_lane_0_0 --> n_lane_0_1
    n_lane_0_1 --> n_lane_0_2
    n_lane_0_2 --> n_lane_0_3
    n_lane_0_3 --> n_lane_0_4
    n_lane_0_4 --> n_lane_0_5
    n_lane_0_5 --> n_lane_0_6
  end
  subgraph lane_1["📄 src/sandbox.rs · 11 ops"]
    direction LR
    n_lane_1_0["READ × 5"]:::o
    n_lane_1_1["EDIT × 3"]:::a
    n_lane_1_2["READ × 2"]:::o
    n_lane_1_3["EDIT"]:::a
    n_lane_1_0 --> n_lane_1_1
    n_lane_1_1 --> n_lane_1_2
    n_lane_1_2 --> n_lane_1_3
  end
  subgraph lane_2["📄 src/supervisor.rs · 1 op"]
    direction LR
    n_lane_2_0["EDIT"]:::a
  end
  subgraph lane_3["📄 src/msg.rs · 1 op"]
    direction LR
    n_lane_3_0["EDIT"]:::a
  end
  subgraph lane_4["📄 src/objects.rs · 1 op"]
    direction LR
    n_lane_4_0["EDIT"]:::a
  end
  subgraph lane_5["🗂 Other · 3 nodes"]
    direction LR
    n_lane_5_0["READ · read btycboekk.output"]:::o
    n_lane_5_1["READ · read btycboekk.output"]:::o
    n_lane_5_2["EDIT · edited src/token_filter.rs"]:::a
    n_lane_5_0 --> n_lane_5_1
    n_lane_5_1 --> n_lane_5_2
  end
  classDef o fill:#dbeafe,stroke:#1e3a8a,color:#0b1c4a;
  classDef t fill:#fef3c7,stroke:#92400e,color:#3f2d05;
  classDef a fill:#dcfce7,stroke:#166534,color:#0a2e16;
  classDef n fill:#ede9fe,stroke:#5b21b6,color:#221251;
  classDef m fill:#e5e7eb,stroke:#374151,color:#0b0f17;
Loading

📜 Per-commit provenance

6ad473dc env: inject IS_SANDBOX=1 for agent-in-box profiles

  • promptimplement the IS_SANDBOX=1 injection for agent profiles and add a test
  • model claude-opus-4-8 · agent claude-code

Generated by h5i · re-run h5i share pr post to refresh.

@Koukyosyumei Koukyosyumei merged commit 9470a8f into main Jun 16, 2026
5 checks passed
@Koukyosyumei Koukyosyumei deleted the bypass-sudo-in-supervised-mode branch June 16, 2026 01:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant