Repository navigation
fix(container-gateway-hook): no here-string; anchor worktree main checkouts - #1790
Merged
Merged
Conversation
potiuk
enabled auto-merge (squash)
October 24, 2026 22:11
potiuk
force-pushed
the
fix/gateway-hook-no-here-string
branch
from
October 24, 2026 22:24
df454ac to
7f5e5af
Compare
github-actions
Bot
added
family:setup
…ckouts link_stays_inside split the link target with `read <<<`. bash 3.2 backs a here-string with a temporary file; when it cannot create one, read gets nothing, the loop never runs and the link passes as staying inside: the check failed open. The target is now split with plain word splitting, globbing off, and a test keeps here-documents out of the hook. A linked worktree's main checkout was re-derived on every run from .git metadata the sandbox can rewrite, so a session could hide the main checkout's grants from the run at its end. The first main checkout the hook confirms is now recorded under ~/.claude/magpie-gateway/worktrees (refused if that is sandbox-writable or a symlink); a later run deriving a different one refuses until the operator deletes the record. Generated-by: Claude (Opus 5.5)
… keys Review follow-up. The record was consulted only while the checkout still looked like a linked worktree, so swapping its .git file for a directory made it disappear; it is now looked up by path first, and a record whose checkout no longer looks linked, names another path, or another main checkout refuses. Keys are SHA-256 of the path rather than cksum, and a record for a different path refuses instead of skipping the check. Generated-by: Claude (Opus 5.5)
…cord Review follow-up. A record in a sandbox-writable directory could have been forged, so the writability check now runs before an existing record is read or trusted, not only before a new one is written. Generated-by: Claude (Opus 5.5)
…very checkout Review follow-up. The check ran only for a linked worktree or an existing record, both of which sandboxed code with write access to the record directory could remove together. It now refuses for every checkout. Generated-by: Claude (Opus 5.5)
…home Rebased onto apache#1789, which treats $HOME as settable by the environment and reads the account database's home. The worktree records now live under that home too: a redirected $HOME would otherwise hand the hook a fresh, empty record store. MAGPIE_CONTAINER_GATEWAY_STATE_DIR replaces the location for tests, under the same writability checks, so the suite never writes into the real account home. Also regenerates the secure-setup fingerprint. Generated-by: Claude (Opus 5.5)
…tore a real run trusts Review follow-up. MAGPIE_CONTAINER_GATEWAY_STATE_DIR is now honoured only in a dry run, which executes nothing, so it keeps the test suite out of the real account home without letting the environment hand a real run a fresh record store. The hook also sets the mode only of directories it creates. Generated-by: Claude (Opus 5.5)
Generated-by: Claude (Opus 5.5)
potiuk
force-pushed
the
fix/gateway-hook-no-here-string
branch
from
October 24, 2026 22:52
f1ea85f to
cb1aafb
Compare
potiuk
added a commit
that referenced
this pull request
Oct 25, 2026
Ships the fixes merged since 0.9.0.dev202610241347 to marketplace installs: the container-gateway hook hardening (#1784, #1789, #1790, #1793, #1804), host-only uv state (#1785), session-start cleanup of the stale uv grant (#1788), the trusted session-start interpreter (#1791), the sandboxed prek home (#1792) and per-machine gateway hook registration (#1797). Generated-by: Claude (Opus 5.5)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to #1784.
link_stays_insidesplit a link target withread <<<. bash 3.2 backs a here-string with a temporary file; when it can't create one,readgets nothing and the link passes as staying inside. The target is now split with plain word splitting (globbing off), and a test keeps here-documents out of the hook..gitmetadata the sandbox can rewrite, so a session could hide the main checkout's grants from the run at its end. The first main checkout the hook confirms is recorded under~/.claude/magpie-gateway/worktrees/, keyed by SHA-256 of the path. Records are looked up by path even if the checkout no longer looks linked, and a mismatch refuses until the operator deletes the record. A sandbox-writable record directory refuses for every checkout.🤖 Generated with Claude Code