mosaicstack/stack
1
0
Fork 0
Code Issues 13 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

P8-016: Security — strict path hardening in file/git/shell tools #169

New Issue
Closed
opened 2026-03-16 01:26:33 +00:00 by jason.woltje · 0 comments
jason.woltje commented 2026-03-16 01:26:33 +00:00
Owner
Copy Link

Harden file-tools.ts, git-tools.ts, shell-tools.ts with strict path validation — reject any resolved path outside sandboxDir (path traversal, symlink escapes). Add unit tests for sandbox escape attempts. Prep for future chroot integration (see docs/plans/chroot-sandboxing.md).

Ref: docs/plans/2026-03-15-agent-platform-architecture.md (RBAC & Filesystem Security, Sandbox Escape Prevention)

Wave 2 — independent, runs after P8-007.

Harden file-tools.ts, git-tools.ts, shell-tools.ts with strict path validation — reject any resolved path outside sandboxDir (path traversal, symlink escapes). Add unit tests for sandbox escape attempts. Prep for future chroot integration (see docs/plans/chroot-sandboxing.md). Ref: docs/plans/2026-03-15-agent-platform-architecture.md (RBAC & Filesystem Security, Sandbox Escape Prevention) Wave 2 — independent, runs after P8-007.
jason.woltje added this to the Phase 8: Polish & Beta (v0.1.0) milestone 2026-03-16 01:26:33 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone Phase 8: Polish & Beta (v0.1.0)
Projects
Clear projects
No project
Assignees
Clear assignees
jason.woltje
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: mosaicstack/stack#169
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?