blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(assistant): retire le plan sandbox project_read_only de l'assistant de ticket (#25)

Browse Source 
La surface « assistant de ticket » imposait un SessionPlan Landlock
restrictif (project_read_only) qui gouvernait la classe exec de la
sandbox OS et empêchait le spawn de la CLI (EACCES / os error 13).

factory.start reçoit désormais SessionPlan::None + sandbox absent :
l'assistant n'impose plus ce plan OS-sandbox. La classe exec n'est
plus verrouillée, le spawn de la CLI aboutit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Blomios
2026-07-07 17:28:30 +02:00
parent 47b1d64e39
commit 961a2cadc4
3 changed files with 4 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
crates/domain/src/sandbox.rs
View File

@ -145,31 +145,6 @@ pub struct SandboxPlan {
pub default_posture: Posture,
}
impl SandboxPlan {
/// Builds the ticket-assistant preset: read-only access to the project root,
/// denied writes by default, while keeping the assistant run directory
/// writable so CLI session metadata/resume files can still function.
#[must_use]
pub fn project_read_only(project_root: impl Into<String>, run_dir: impl Into<String>) -> Self {
let project_root = project_root.into();
let run_dir = run_dir.into();
let mut allowed = vec![PathGrant {
abs_root: project_root,
access: PathAccess::RO,
}];
if !run_dir.trim().is_empty() {
allowed.push(PathGrant {
abs_root: run_dir,
access: PathAccess::RO | PathAccess::RW,
});
}
Self {
allowed,
default_posture: Posture::Deny,
}
}
}
/// Immutable inputs [`compile_sandbox_plan`] interpolates into the absolute roots
/// it emits. Borrowed: a plan is computed at the launch site, never stored.
pub struct SandboxContext<'a> {
@ -490,19 +465,6 @@ mod tests {
assert!(!g.access.contains(PathAccess::RW));
}
#[test]
fn project_read_only_preset_allows_project_read_and_run_dir_write_only() {
let plan = SandboxPlan::project_read_only(ROOT, "/home/anthony/.ideai/run/assistant");
let project = grant(&plan, ROOT).expect("project root granted");
assert_eq!(project.access, PathAccess::RO);
assert!(!project.access.contains(PathAccess::RW));
let run = grant(&plan, "/home/anthony/.ideai/run/assistant").expect("run dir granted");
assert!(run.access.contains(PathAccess::RO));
assert!(run.access.contains(PathAccess::RW));
assert_eq!(plan.default_posture, Posture::Deny);
}
#[test]
fn write_and_delete_map_to_rw() {
let e = eff(