env: inject IS_SANDBOX=1 for agent-in-box profiles#146
Merged
Conversation
Agent profiles map the agent to root-in-userns on the egress tiers (nft needs CAP_NET_ADMIN across execve), so Claude Code's getuid()==0 guard refuses --dangerously-skip-permissions. Inject IS_SANDBOX=1 to skip only that root check -- the box still pins the agent to the real unprivileged host uid, so no real capability is granted. Scoped to agent profiles; caller/env.pass-supplied IS_SANDBOX wins. Co-Authored-By: Claude Opus 4.8 <[email protected]>
Collaborator
Author
🪙 100% AI-authored · 5 files
💬 The ask
📍 What shipped
Tip ✅ Security scan cleanNo credentials leaked in this branch's diff. h5i scanned every added line against the secret rule pack and found nothing to rotate. Note Duplicate-code scan clean — no copy-paste blocks introduced. 🧠 Reasoning by file — 6241 nodes across 6 lanes, latest 24 only%%{init: {"flowchart": {"nodeSpacing": 42, "rankSpacing": 48, "diagramPadding": 14}, "themeVariables": {"fontSize": "18px"}} }%%
flowchart TB
subgraph lane_0["💭 Reasoning · 7 steps"]
direction LR
n_lane_0_0["THINK · Since these are comment-only changes, let me run a quick `cargo check` t…"]:::t
n_lane_0_1["NOTE · PLACEHOLDER (~/Dev/h5i/.git/.h5i/env/human/update-comments/work/src/toke…"]:::n
n_lane_0_2["MERGE · merged 'env/human/update-comments' into 'improve-shell'"]:::m
n_lane_0_3["THINK · Let me confirm the agent profile triggers the egress (uid-0) path and ch…"]:::t
n_lane_0_4["THINK · Let me follow the project rules and check context, then explore the rele…"]:::t
n_lane_0_5["THINK · I'll add a helper and apply it centrally in both dispatch functions."]:::t
n_lane_0_6["NOTE · DEFERRAL: y. 2. **The `powerline-shell: Permission denied` line is a sep…"]:::n
n_lane_0_0 --> n_lane_0_1
n_lane_0_1 --> n_lane_0_2
n_lane_0_2 --> n_lane_0_3
n_lane_0_3 --> n_lane_0_4
n_lane_0_4 --> n_lane_0_5
n_lane_0_5 --> n_lane_0_6
end
subgraph lane_1["📄 src/sandbox.rs · 11 ops"]
direction LR
n_lane_1_0["READ × 5"]:::o
n_lane_1_1["EDIT × 3"]:::a
n_lane_1_2["READ × 2"]:::o
n_lane_1_3["EDIT"]:::a
n_lane_1_0 --> n_lane_1_1
n_lane_1_1 --> n_lane_1_2
n_lane_1_2 --> n_lane_1_3
end
subgraph lane_2["📄 src/supervisor.rs · 1 op"]
direction LR
n_lane_2_0["EDIT"]:::a
end
subgraph lane_3["📄 src/msg.rs · 1 op"]
direction LR
n_lane_3_0["EDIT"]:::a
end
subgraph lane_4["📄 src/objects.rs · 1 op"]
direction LR
n_lane_4_0["EDIT"]:::a
end
subgraph lane_5["🗂 Other · 3 nodes"]
direction LR
n_lane_5_0["READ · read btycboekk.output"]:::o
n_lane_5_1["READ · read btycboekk.output"]:::o
n_lane_5_2["EDIT · edited src/token_filter.rs"]:::a
n_lane_5_0 --> n_lane_5_1
n_lane_5_1 --> n_lane_5_2
end
classDef o fill:#dbeafe,stroke:#1e3a8a,color:#0b1c4a;
classDef t fill:#fef3c7,stroke:#92400e,color:#3f2d05;
classDef a fill:#dcfce7,stroke:#166534,color:#0a2e16;
classDef n fill:#ede9fe,stroke:#5b21b6,color:#221251;
classDef m fill:#e5e7eb,stroke:#374151,color:#0b0f17;
📜 Per-commit provenance
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Agent profiles map the agent to root-in-userns on the egress tiers (nft needs CAP_NET_ADMIN across execve), so Claude Code's getuid()==0 guard refuses --dangerously-skip-permissions. Inject IS_SANDBOX=1 to skip only that root check -- the box still pins the agent to the real unprivileged host uid, so no real capability is granted. Scoped to agent profiles; caller/env.pass-supplied IS_SANDBOX wins.