From 255189051b7885f1b6685411f29ea783f1036c79 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 21 Apr 2026 21:09:33 +0200 Subject: [PATCH] sandbox: fix regression from simplification - Add {CWD} to rwx (session working directory, was in DefaultConfig) - Add /usr /lib /lib64 /bin /sbin to rox (system binaries) - Add {TMPDIR} to rwx - Add all OLLIE_* env vars (SESSION_ID, CFG_PATH, DATA_PATH, etc.) - Replace {PWD} with {CWD} in restricted sandbox - Remove orphaned cwd: top-level field (not parsed by Config struct) --- .kiro/settings/lsp.json | 198 ++++++++++++++++++++++++++++++++++++++++ sandbox/default.yaml | 17 +++- sandbox/restricted.yaml | 11 ++- 3 files changed, 220 insertions(+), 6 deletions(-) create mode 100644 .kiro/settings/lsp.json diff --git a/.kiro/settings/lsp.json b/.kiro/settings/lsp.json new file mode 100644 index 0000000..b5ac334 --- /dev/null +++ b/.kiro/settings/lsp.json @@ -0,0 +1,198 @@ +{ + "languages": { + "cpp": { + "name": "clangd", + "command": "clangd", + "args": [ + "--background-index" + ], + "file_extensions": [ + "cpp", + "cc", + "cxx", + "c", + "h", + "hpp", + "hxx" + ], + "project_patterns": [ + "CMakeLists.txt", + "compile_commands.json", + "Makefile" + ], + "exclude_patterns": [ + "**/build/**", + "**/cmake-build-**/**" + ], + "multi_workspace": false, + "initialization_options": {}, + "request_timeout_secs": 60 + }, + "java": { + "name": "jdtls", + "command": "jdtls", + "args": [], + "file_extensions": [ + "java" + ], + "project_patterns": [ + "pom.xml", + "build.gradle", + "build.gradle.kts", + ".project" + ], + "exclude_patterns": [ + "**/target/**", + "**/build/**", + "**/.gradle/**" + ], + "multi_workspace": false, + "initialization_options": { + "settings": { + "java": { + "compile": { + "nullAnalysis": { + "mode": "automatic" + } + }, + "configuration": { + "annotationProcessing": { + "enabled": true + } + } + } + } + }, + "request_timeout_secs": 60 + }, + "python": { + "name": "pyright", + "command": "pyright-langserver", + "args": [ + "--stdio" + ], + "file_extensions": [ + "py" + ], + "project_patterns": [ + "pyproject.toml", + "setup.py", + "requirements.txt", + "pyrightconfig.json" + ], + "exclude_patterns": [ + "**/__pycache__/**", + "**/venv/**", + "**/.venv/**", + "**/.pytest_cache/**" + ], + "multi_workspace": false, + "initialization_options": {}, + "request_timeout_secs": 60 + }, + "rust": { + "name": "rust-analyzer", + "command": "rust-analyzer", + "args": [], + "file_extensions": [ + "rs" + ], + "project_patterns": [ + "Cargo.toml" + ], + "exclude_patterns": [ + "**/target/**" + ], + "multi_workspace": false, + "initialization_options": { + "cargo": { + "buildScripts": { + "enable": true + } + }, + "diagnostics": { + "enable": true, + "enableExperimental": true + }, + "workspace": { + "symbol": { + "search": { + "scope": "workspace" + } + } + } + }, + "request_timeout_secs": 60 + }, + "go": { + "name": "gopls", + "command": "gopls", + "args": [], + "file_extensions": [ + "go" + ], + "project_patterns": [ + "go.mod", + "go.sum" + ], + "exclude_patterns": [ + "**/vendor/**" + ], + "multi_workspace": false, + "initialization_options": { + "usePlaceholders": true, + "completeUnimported": true + }, + "request_timeout_secs": 60 + }, + "typescript": { + "name": "typescript-language-server", + "command": "typescript-language-server", + "args": [ + "--stdio" + ], + "file_extensions": [ + "ts", + "js", + "tsx", + "jsx" + ], + "project_patterns": [ + "package.json", + "tsconfig.json" + ], + "exclude_patterns": [ + "**/node_modules/**", + "**/dist/**" + ], + "multi_workspace": false, + "initialization_options": { + "preferences": { + "disableSuggestions": false + } + }, + "request_timeout_secs": 60 + }, + "ruby": { + "name": "solargraph", + "command": "solargraph", + "args": [ + "stdio" + ], + "file_extensions": [ + "rb" + ], + "project_patterns": [ + "Gemfile", + "Rakefile" + ], + "exclude_patterns": [ + "**/vendor/**", + "**/tmp/**" + ], + "multi_workspace": false, + "initialization_options": {}, + "request_timeout_secs": 60 + } + } +} \ No newline at end of file diff --git a/sandbox/default.yaml b/sandbox/default.yaml index f0ebcd7..3624b24 100644 --- a/sandbox/default.yaml +++ b/sandbox/default.yaml @@ -1,5 +1,4 @@ # Default execute_code sandbox configuration. -cwd: "{CWD}" filesystem: ro: - "{XDG_CONFIG_HOME}/git" @@ -75,12 +74,18 @@ filesystem: - "/dev/null" - "/dev/fuse" rox: + - "/usr" + - "/lib" + - "/lib64" + - "/bin" + - "/sbin" - "{HOME}/go/bin" - "{HOME}/env" - "/proc/self/fd" - "/proc/self/cmdline" rwx: - - "{PWD}" + - "{CWD}" + - "{TMPDIR}" - "{PLAN9}" - "{HOME}/bin" - "{OLLIE}" @@ -100,8 +105,15 @@ filesystem: env: - NAMESPACE - OLLIE + - OLLIE_CFG_PATH + - OLLIE_DATA_PATH - OLLIE_MEMORY_PATH - OLLIE_PLAN_PATH + - OLLIE_SESSION_ID + - OLLIE_SKILLS_PATH + - OLLIE_TMP_PATH + - OLLIE_TOOLS_PATH + - OLLIE_TRANSCRIPT_PATH - HOME - TMPDIR - PLAN9 @@ -116,6 +128,5 @@ env: - EDITOR - GIT_SEQUENCE_EDITOR - SUPERPOWERD_SESSION_TOKEN - - PWD network: unrestricted: true diff --git a/sandbox/restricted.yaml b/sandbox/restricted.yaml index f69137a..ca0360d 100644 --- a/sandbox/restricted.yaml +++ b/sandbox/restricted.yaml @@ -1,5 +1,4 @@ # Sample minimal-permission sandbox for execute_code -cwd: temp # Use temp workspace (cleaned up after execution) filesystem: ro: - "/etc/alternatives" @@ -26,13 +25,20 @@ filesystem: - "/tmp" - "{NAMESPACE}" rwx: - - "{PWD}" + - "{CWD}" - "{OLLIE}" env: - NAMESPACE - OLLIE + - OLLIE_CFG_PATH + - OLLIE_DATA_PATH - OLLIE_MEMORY_PATH - OLLIE_PLAN_PATH + - OLLIE_SESSION_ID + - OLLIE_SKILLS_PATH + - OLLIE_TMP_PATH + - OLLIE_TOOLS_PATH + - OLLIE_TRANSCRIPT_PATH - PATH - HOME - PLAN9 @@ -43,6 +49,5 @@ env: - XDG_RUNTIME_DIR - TMPDIR - SUPERPOWERD_SESSION_TOKEN - - PWD network: unrestricted: true