blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(assistant): retire le plan sandbox project_read_only de l'assistant de ticket (#25)

Browse Source 
La surface « assistant de ticket » imposait un SessionPlan Landlock
restrictif (project_read_only) qui gouvernait la classe exec de la
sandbox OS et empêchait le spawn de la CLI (EACCES / os error 13).

factory.start reçoit désormais SessionPlan::None + sandbox absent :
l'assistant n'impose plus ce plan OS-sandbox. La classe exec n'est
plus verrouillée, le spawn de la CLI aboutit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-07 17:28:30 +02:00
parent 47b1d64e39
commit 961a2cadc4
3 changed files with 4 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
crates/application/src/ticket_assistant.rs
View File

@ -3,10 +3,10 @@
use std::sync::Arc;
use domain::ports::{AgentSessionFactory, SessionPlan};
use domain::{AgentProfile, ProjectPath};
use domain::AgentProfile;
use domain::{
AgentToolPolicy, AgentToolPolicyStore, AssistantContextProvider, DomainEvent, EventBus,
IssueRef, IssueStore, ProfileId, ProfileStore, Project, SandboxPlan, SessionId,
IssueRef, IssueStore, ProfileId, ProfileStore, Project, SessionId,
};
use crate::terminal::StructuredSessions;
@ -94,7 +94,6 @@ impl OpenTicketAssistant {
.prepare_ticket_assistant_context(&input.project, &issue)
.await
.map_err(|e| AppError::Store(e.to_string()))?;
let sandbox = ticket_assistant_sandbox(&input.project.root, input.issue_ref);
let session = self
.factory
.start(
@ -102,7 +101,7 @@ impl OpenTicketAssistant {
&prepared,
&input.project.root,
&SessionPlan::None,
Some(&sandbox),
None,
)
.await
.map_err(AppError::from)?;
@ -197,26 +196,3 @@ async fn find_profile(
.find(|profile| profile.id == profile_id)
.ok_or_else(|| AppError::NotFound(format!("profile {profile_id}")))
}
fn ticket_assistant_sandbox(project_root: &ProjectPath, issue_ref: IssueRef) -> SandboxPlan {
let run_dir = format!(
"{}/.ideai/run/ticket-assistant-{}",
project_root.as_str().trim_end_matches(['/', '\\']),
issue_ref.number().get()
);
SandboxPlan::project_read_only(project_root.as_str().to_owned(), run_dir)
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn sandbox_uses_project_read_only_preset() {
let root = ProjectPath::new("/tmp/project").unwrap();
let issue_ref = IssueRef::from(domain::IssueNumber::new(7).unwrap());
let plan = ticket_assistant_sandbox(&root, issue_ref);
assert_eq!(plan.allowed[0].abs_root, "/tmp/project");
assert_eq!(plan.default_posture, domain::permission::Posture::Deny);
}
}