lywsvip/sandbox-runtime
1
0
Fork 0
mirror of https://github.com/anthropic-experimental/sandbox-runtime.git synced 2026-05-06 13:40:59 +08:00
Code Issues Packages Projects Releases Wiki Activity

improve corner-case handling

Browse Source
This commit is contained in:
Chris Arderne
2026-03-08 10:41:22 +00:00
parent 75944d896a
commit 1f696a2eba
2 changed files with 6 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/sandbox/linux-sandbox-utils.ts
View File

@@ -962,10 +962,7 @@ export async function wrapCommandWithSandboxLinux(
// Determine if we have restrictions to apply
// Read: denyOnly pattern - empty array means no restrictions
// Write: allowOnly pattern - undefined means no restrictions, any config means restrictions
const hasReadRestrictions =
readConfig &&
(readConfig.denyOnly.length > 0 ||
(readConfig.allowWithinDeny?.length ?? 0) > 0)
const hasReadRestrictions = readConfig && readConfig.denyOnly.length > 0
const hasWriteRestrictions = writeConfig !== undefined
// Check if we need any sandboxing

11
src/sandbox/macos-sandbox-utils.ts
View File

@@ -247,12 +247,14 @@ function generateReadRules(
const regexPattern = globToRegex(normalizedPath)
rules.push(
`(allow file-read*`,
` (regex ${escapePath(regexPattern)}))`,
` (regex ${escapePath(regexPattern)})`,
` (with message "${logTag}"))`,
)
} else {
rules.push(
`(allow file-read*`,
` (subpath ${escapePath(normalizedPath)}))`,
` (subpath ${escapePath(normalizedPath)})`,
` (with message "${logTag}"))`,
)
}
}
@@ -686,10 +688,7 @@ export function wrapCommandWithSandboxMacOS(
// Determine if we have restrictions to apply
// Read: denyOnly pattern - empty array means no restrictions
// Write: allowOnly pattern - undefined means no restrictions, any config means restrictions
const hasReadRestrictions =
readConfig &&
(readConfig.denyOnly.length > 0 ||
(readConfig.allowWithinDeny?.length ?? 0) > 0)
const hasReadRestrictions = readConfig && readConfig.denyOnly.length > 0
const hasWriteRestrictions = writeConfig !== undefined
// No sandboxing needed