[pull] main from xintaofei:main - #159
Merged
Merged
Conversation
The ACP `fs/read_text_file` / `fs/write_text_file` handlers confined every path to the session working directory, with no way to configure it. Agents that keep state outside any workspace could not use the channel codeg advertises to them: Grok's plan mode writes `<GROK_HOME>/sessions/<cwd>/<id>/plan.md` and reads `<GROK_HOME>/skills`, so those calls failed and Grok fell back to writing the file through a shell heredoc instead. - Replace the single hardcoded root with an `FsAccessPolicy`. Reads are unrestricted by default; writes are limited to the workspace, the agent's own data home, the temp dirs, and any user-listed extra roots. The 16MB/2MB size caps and the parent-directory rules are unchanged. - Add `CODEG_ACP_FS_POLICY` (`default` | `strict` | `unrestricted`) and `CODEG_ACP_FS_EXTRA_ROOTS`. Both resolve from the agent's `env_json` before codeg's own environment, so they can be set per agent from the existing settings UI; `strict` restores the previous behavior. - Derive each agent's data home from a declarative table that mirrors the resolvers in `parsers/`, carrying every relocation variable in its resolver's precedence order plus the sub-path and trim semantics that resolver applies. A test pins the table against those resolvers so the two cannot drift. - Track the environment the launched child actually sees: a non-blank `runtime_env` value replaces the parent's, a blank one is removed by the spawn layer so the agent falls back to its own default, and an absent one is inherited. Home-relative defaults follow the child's `HOME` / `USERPROFILE` rather than codeg's, so an isolated profile stays isolated and the inactive one is not writable. - Refuse a root that cannot be named safely instead of guessing: relative values are never resolved against codeg's cwd, and values are never trimmed or tilde-expanded, either of which could widen a root to `$HOME` or `/`. Containment is still checked on the canonicalized target, so a symlink leading out of an allowed root is rejected.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
See Commits and Changes for more details.
Created by
pull[bot] (v2.0.0-alpha.4)
Can you help keep this open source service alive? 💖 Please sponsor : )