Repository navigation
fix(setup): drop the stale ~/.local/share/uv sandbox grant at session start - #1788
Merged
potiuk merged 4 commits intoOct 24, 2026
Merged
Conversation
… start sandbox-add-project-root.sh removes the old ~/.local/share/uv write grant (apache#1785) only when it runs, so a project nobody checks out or upgrades keeps it, and sandboxed code there can still change the interpreters and tools uv runs outside the sandbox. magpie-setup's session-start hook now removes the exact entries the helper once added from the checkout's gitignored .claude/settings.local.json (and the main checkout's, in a linked worktree), and tells the user in a systemMessage. A broader grant, or one in user-scope, committed or tracked settings, is reported for the user to remove. Generated-by: Claude (Opus 5.5)
Review follow-up; the hook runs outside the sandbox over a sandbox-writable tree. It wrote through a fixed settings.local.json.tmp name a sandboxed command could plant as a symlink; it now writes a fresh mkstemp file beside the target and refuses when .claude or the file is a symlink. It ran `git check-ignore`, which the repository's own sandbox-writable config can turn into command execution (core.fsmonitor); no git runs now, and a tracked settings.local.json is cleaned too, since dropping the grant only narrows the sandbox. It followed a linked worktree's .git pointer to the main checkout, letting sandboxed code choose the directory it rewrites; it now cleans only the session's own checkout. Generated-by: Claude (Opus 5.5)
Review follow-up. Checking for symlinks and then writing by path left a window in which a sandboxed process still running from an earlier session could swap .claude for a symlink. The cleanup now opens .claude once with O_NOFOLLOW and does the read (O_NOFOLLOW), the fresh temporary file (O_EXCL|O_NOFOLLOW, random name) and the rename relative to that descriptor, so nothing that happens to the path meanwhile redirects it. Generated-by: Claude (Opus 5.5)
github-actions
Bot
added
family:setup
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Builds the session-start message and context as lists instead of conditional generator parts (CodeQL: potentially uninitialized local), and replaces the silent except around the temporary-file cleanup with a commented contextlib.suppress (CodeQL: empty except). Generated-by: Claude (Opus 5.5)
potiuk
enabled auto-merge (squash)
October 24, 2026 21:21
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Ships the fixes merged since 0.9.0.dev202610241347 to marketplace installs: the container-gateway hook hardening (#1784, #1789, #1790, #1793, #1804), host-only uv state (#1785), session-start cleanup of the stale uv grant (#1788), the trusted session-start interpreter (#1791), the sandboxed prek home (#1792) and per-machine gateway hook registration (#1797). Generated-by: Claude (Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
#1785 made
~/.local/share/uvread-only to the sandbox, andsandbox-add-project-root.shnow removes the write grant older versions added — but only when it runs (on checkout, adopt or upgrade). A project nobody checks out or upgrades keeps the grant, and sandboxed code there can still change the interpreters and tools uv runs outside the sandbox.magpie-setup's session-start hook now cleans it up the next time a session opens:
.claude/settings.local.json, and tells the user in asystemMessage. Nothing else in the file changes..gitpointer, and does the read, a fresh temporary file and the rename through oneO_NOFOLLOWdirectory descriptor.~/.local,~, a subdirectory of the uv dir), or one in user-scope or committed settings, is reported for the user to remove, not rewritten.🤖 Generated with Claude Code