fix(runtime): Preserve sandbox metadata - #65
Merged
Conversation
…roval Avoids rejecting approvals when suspension becomes resumable before transcript persistence completes. Polls briefly for the suspended assistant seed and fails on timeout or cancellation.
…secrets Provide a complete sandbox for multi-backend agent development, including Go, Flanksource tools, browser automation, and shell utilities. Embed the dependency manifest and pass GitHub credentials through BuildKit secrets to keep release resolution reliable without leaking tokens into image layers. Claude-Session-Id: b5841c80-b074-4324-9370-4f1d38d793ea
The root Dockerfile/entrypoint.sh were byte-identical copies of pkg/container/base/*, but only the latter pair is //go:embed-ed and actually built as claude-env:base. Nothing referenced the root copies — .goreleaser.yaml has no dockers: block and no Makefile/Taskfile/workflow target used them — so they were pure drift surface. Completes the single-source consolidation started in e6ed4cdd, whose README already points at pkg/container/base/Dockerfile. Claude-Session-Id: b5841c80-b074-4324-9370-4f1d38d793ea
Adds a docker job to the release workflow that builds pkg/container/base/Dockerfile for linux/amd64 and linux/arm64 and pushes it to Docker Hub and GHCR, reusing flanksource/action-workflows publish-multi-platform-docker-image (pinned to v1.2.1). Each platform builds on a native runner and is published by digest, so consumers never see a partially assembled index. The job runs after goreleaser rather than in parallel: the image installs flanksource/captain via deps at 'latest', so the tag's release assets must exist first or the image would ship the previous release's binary. The reusable workflow already forwards GITHUB_TOKEN as a BuildKit secret, which is exactly what the Dockerfile's deps layer consumes to avoid GitHub's unauthenticated API rate limit. Claude-Session-Id: b5841c80-b074-4324-9370-4f1d38d793ea
Moves the docker job out of the release workflow into its own workflow_dispatch-only 'Publish Image' workflow. The image is ~6.3GB and takes two native-runner builds to assemble, which is a lot to spend on every patch release of a Go binary — and Release's own workflow_dispatch is for cutting a tag, so gating the job inside it would conflate the two triggers. Dispatching from a tag ref builds that tag, since the reusable workflow checks out the calling ref. A resolve job derives the image tags, defaulting the version to the most recent reachable tag and rejecting values containing commas or whitespace before they reach the reusable workflow's tag parser. Publishing :latest and the platform list are inputs so an older tag can be republished without moving :latest. Claude-Session-Id: b5841c80-b074-4324-9370-4f1d38d793ea
Exercise commit hooks through the real Runner so committing/committed notices remain visible in streamed and buffered run output. Allow the generated webapp entrypoint to be tracked for commit validation.
Prevent AI backends from silently granting broader access than requested. Propagate Claude deny-lists, emit Codex approval policies, reject unsupported per-tool policies, and resolve sandbox selections for HTTP/spec runs. BREAKING CHANGE: Backends without per-tool policy support now reject requests specifying permissions.tools; unbrokered Claude runs use the restricted default instead of bypassing permissions.
…criptors Retain execution metadata when overriding the sandbox backend and prevent detached agents from keeping Git pushes open through inherited descriptors. Add regression coverage for descriptor inheritance.
moshloop
enabled auto-merge (rebase)
August 11, 2026 08:07
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (14)
🚧 Files skipped from review as they are similar to previous changes (5)
WalkthroughThe PR adds backend permission-policy validation, posture-aware approvals, sandbox resolution, an expanded container image and publishing workflow, descriptor inheritance controls, commit notice coverage, and repository integration updates. ChangesPermission policy and approval handling
Run sandbox resolution
Base image and publishing
Agent descriptor inheritance
Commit notice coverage
Repository integration updates
Possibly related PRs
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1📝 Generate docstrings 💡
🧪 Generate unit tests (beta)
✨ Simplify code
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Gavel summary
Totals: 0 passed · 0 failed · 0 skipped · - |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Gavel summary
Totals: 3539 passed · 0 failed · 10 skipped · 2m45s |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/ai/provider/codex_appserver.go`:
- Around line 134-138: Move the c.setPosture(postureFor(req)) call in
ExecuteStream to immediately after c.turnMu.Lock(), ensuring each turn’s posture
is set only after acquiring the turn lock. Add a concurrent-turn regression test
where a restricted first request and bypass second request verify the first
turn’s approval cannot use the second posture.
In `@pkg/api/registry/providers.go`:
- Line 24: The Claude Agent adapter must enforce every tool policy it accepts
before advertising support. In pkg/ai/provider/claudeagent/provider.go:456,
normalize req.Permissions.Tools.Policies(), forward all resulting deny policies
to DisallowedTools, and reject unsupported ask/auto policies (or implement their
Claude Agent equivalents); then update pkg/api/registry/providers.go:24 so
ModeAgent.ToolPolicy is not advertised unless this complete enforcement is
available.
In `@pkg/cli/prompt_render_test.go`:
- Around line 201-280: Extend TestRenderPromptResolvesSandbox with a case whose
override SandboxRef includes both Agent and Policy, then assert
rendered.Input.Sandbox preserves those values and
rendered.Config.ResolvedSandbox() retains them after overlayRuntimeSpec and
applyRunSandbox. Keep the existing sandbox-kind assertions intact.
In `@pkg/container/base/Dockerfile`:
- Around line 85-86: Update the Go installation RUN step to download the
architecture-specific archive selected by GO_VERSION and dpkg
--print-architecture into a temporary file, verify it against the pinned
official SHA-256 checksum for that version and architecture, and only then
extract it into /usr/local as root. Remove the direct curl-to-tar pipeline while
preserving support for both GO_VERSION and the detected architecture.
- Line 2: Make all base-image build inputs immutable: in
pkg/container/base/Dockerfile lines 2, 14-16, 90, and 130-138, pin the base
image digest, set explicit versions for the three agent CLI arguments and
Ginkgo, pin the Playwright package, and lock global npm packages with versions
and integrity or a lockfile; in pkg/container/base/deps.yaml lines 57-62, pin
task, golangci-lint, gavel, repomap, and captain. Update
.github/workflows/publish-image.yml to pass the selected build arguments through
to the image build.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 8775d626-11b0-4996-b3ca-dc7a9e23d4ce
⛔ Files ignored due to path filters (1)
go.sumis excluded by!**/*.sum
📒 Files selected for processing (43)
.gavel.yaml.github/workflows/publish-image.yml.gitignoreDockerfileREADME.mdentrypoint.shgo.modpkg/ai/agent/commit/notice_test.gopkg/ai/provider/claude_cli_test.gopkg/ai/provider/claudeagent/agent.tspkg/ai/provider/claudeagent/bridge_params.gopkg/ai/provider/claudeagent/permissions_test.gopkg/ai/provider/claudeagent/provider.gopkg/ai/provider/cmux/provider.gopkg/ai/provider/codex_appserver.gopkg/ai/provider/codex_appserver_approval.gopkg/ai/provider/codex_appserver_params_test.gopkg/ai/provider/codex_appserver_protocol.gopkg/ai/provider/codex_cli.gopkg/ai/provider/codex_cli_test.gopkg/ai/provider/gemini_cli.gopkg/ai/provider/genkit/genkit.gopkg/aichat/approval_execution.gopkg/aichat/approval_execution_test.gopkg/api/permissions.gopkg/api/registry/backend.gopkg/api/registry/provider.gopkg/api/registry/providers.gopkg/api/tool_policy_support_test.gopkg/cli/ai_prompt_file.gopkg/cli/ai_sandbox.gopkg/cli/prompt_render.gopkg/cli/prompt_render_test.gopkg/container/base/Dockerfilepkg/container/base/deps.yamlpkg/container/base_image.gopkg/container/base_image_test.gopkg/container/build.gopkg/gitagent/workspace.gopkg/gitagent/workspace_descriptors.gopkg/gitagent/workspace_descriptors_darwin.gopkg/gitagent/workspace_descriptors_linux.gopkg/gitagent/workspace_ginkgo_test.go
💤 Files with no reviewable changes (3)
- entrypoint.sh
- Dockerfile
- pkg/gitagent/workspace.go
Prevent AI transports from silently dropping tool restrictions or accepting unenforceable per-tool prompts, and serialize Codex approval posture updates per turn. Preserve sandbox agent and policy metadata during prompt rendering. Pin container dependencies, base images, tool versions, and Go checksums while allowing deliberate workflow overrides. BREAKING CHANGE: Per-tool ask policies are now rejected, and unsupported backends fail instead of running without requested restrictions. Claude-Session-Id: 00f6645c-67f0-4e1e-a840-a600b23e945c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Notes
Summary by CodeRabbit
New Features
Bug Fixes
Documentation