Repository navigation
fix(container-gateway-hook): count the real cwd and home as writable, whatever the environment says - #1789
Merged
Conversation
… whatever the environment says The hook runs outside the sandbox and refuses any interpreter or gateway source under a sandbox-writable root, but two inputs to that set came from the session environment: git's toplevel (GIT_DIR, GIT_WORK_TREE, core.worktree) and $HOME. Drop inherited GIT_* variables, always count the physical cwd and refuse a toplevel that does not contain it, and count the account database's home (its .cache, .local and user settings) alongside $HOME, each uv exemption relaxing only its own home's .local. Document that CLI-only grants are invisible to a hook. Generated-by: Claude Opus 5
potiuk
enabled auto-merge (squash)
October 24, 2026 21:58
github-actions
Bot
added
family:setup
potiuk
added a commit
to potiuk/magpie
that referenced
this pull request
Oct 24, 2026
…home Rebased onto apache#1789, which treats $HOME as settable by the environment and reads the account database's home. The worktree records now live under that home too: a redirected $HOME would otherwise hand the hook a fresh, empty record store. MAGPIE_CONTAINER_GATEWAY_STATE_DIR replaces the location for tests, under the same writability checks, so the suite never writes into the real account home. Also regenerates the secure-setup fingerprint. Generated-by: Claude (Opus 5.5)
8 tasks done
potiuk
added a commit
to potiuk/magpie
that referenced
this pull request
Oct 24, 2026
…home Rebased onto apache#1789, which treats $HOME as settable by the environment and reads the account database's home. The worktree records now live under that home too: a redirected $HOME would otherwise hand the hook a fresh, empty record store. MAGPIE_CONTAINER_GATEWAY_STATE_DIR replaces the location for tests, under the same writability checks, so the suite never writes into the real account home. Also regenerates the secure-setup fingerprint. Generated-by: Claude (Opus 5.5)
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Ships the fixes merged since 0.9.0.dev202610241347 to marketplace installs: the container-gateway hook hardening (#1784, #1789, #1790, #1793, #1804), host-only uv state (#1785), session-start cleanup of the stale uv grant (#1788), the trusted session-start interpreter (#1791), the sandboxed prek home (#1792) and per-machine gateway hook registration (#1797). Generated-by: Claude (Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Follow-up to #1784. The container-gateway session hook runs outside the sandbox, so what it counts as sandbox-writable decides whether a sandboxed command can plant code that later runs unsandboxed. Two inputs to that decision came from the session environment, which project settings can set:
GIT_DIR/GIT_WORK_TREE(or acore.worktreein the writable.git/config) madegit rev-parse --show-toplevelreport another directory, so the real project was not counted as writable and its settings grants were not read; a gateway source planted there was accepted. The hook now drops every inheritedGIT_*variable, always counts the physical session cwd as writable and reads its settings, and refuses to start when the reported toplevel does not contain the cwd.$HOME. WithHOMEpointed elsewhere, the real~/.cache,~/.localand user settings dropped out of the writable set. The hook now also counts the account database's home (~user, not$HOME): its.cache, its.localand its user settings. Each home's uv-interpreter exemption relaxes only that home's.local, so a$HOMEnested inside the account's~/.localexempts nothing there.--add-dir, a--settingsfile) are invisible to a hook; they come from whoever launches the session, not from the repository.Type of change
Test plan
prek runon the changed files passes (isolated-setup fingerprint regenerated)pytest tools/agent-isolation/tests/test_container_gateway_hook.py(outside/tmp/claude*, where the suite does not skip): 67 passedGIT_WORK_TREE, plantedcore.worktree, redirectedHOME,HOMEnested in the account's~/.local— each fails on the hook it guards against and passes nowroborevreview; the last cleanRFC-AI-0004 compliance
Gen-AI disclosure: drafted with Claude Code (Opus 5); reviewed by the submitter.
🤖 Generated with Claude Code