blomios/IdeA
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(agents): ne relaye plus le plan de sandbox OS aux providers structurés — #227

Browse Source 
Les grants Landlock RO/RW empêchaient la custom CLI de démarrer côté web
téléphone avant d'atteindre le project root. Les providers structurés/headless
gèrent leur propre sandbox compatible CLI.
This commit is contained in:
Blomios
2026-08-20 14:07:07 +02:00
parent 93d89e0446
commit e2d423f986
2 changed files with 35 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
crates/application/src/agent/lifecycle.rs
View File

@ -2439,7 +2439,7 @@ impl LaunchAgent {
input.node_id,
size,
&spec.env,
spec.sandbox.as_ref(),
None,
structured_policy.as_ref(),
launch_managed_temp,
local_model_server_guard,
@ -2547,8 +2547,9 @@ impl LaunchAgent {
launch_managed_temp: Option<LaunchManagedTemp>,
model_server_guard: Option<ModelServerUseGuard>,
) -> Result<LaunchAgentOutput, AppError> {
// Relaie le plan de sandbox OS (lot LP4-4) à la fabrique : `spec.sandbox`,
// déjà compilé (pur, domaine) en step 5d. `None` ⇒ exécution native inchangée.
// Structured/headless providers manage their own CLI-compatible sandbox
// policy. Do not relay the OS SandboxPlan here: RO/RW Landlock grants can
// make custom CLIs fail before they reach the project root.
let session = match factory
.start(
profile,