Cause: the workspace.execTool sandbox only granted the project root
plus read-only system roots, so CLI tools like git failed when opening
/dev/null with O_RDWR (redirect/exec 3<>/dev/null) inside sandboxed
runs.
Fix: workspace_exec_sandbox pushes one precise /dev/null PathGrant with
RO|RW access; project read effect stays RO|EXEC and no blanket /dev
grant is added, so the widening is limited to the null device;
GitPlugin untouched. Tests: application asserts the read sandbox keeps
project RO|EXEC while granting /dev/null RO|RW
(workspace_exec_read_sandbox_grants_dev_null_without_widening_project_access);
infrastructure proves the local runner executes exec 3<>/dev/null
(local_runner_allows_cli_to_open_dev_null_for_read_and_write).
QA verte reconfirmée par Git: cargo test -p application workspace_exec
5/5, -p infrastructure local_runner_allows_cli_to_open_dev_null 1/1,
-p infrastructure workspace_tool::tests 5/5, cargo fmt --all --check,
git diff --check.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
#346 — capacités plugin SCM: le manifeste permissions.workspaceExec
(contrat SDK 8ff0f47) est appliqué côté hôte — domain PluginWorkspaceExec
Rule/Effect + audit sink, port WorkspaceToolRunner, adapter
LocalWorkspaceToolRunner sandboxé (concurrence 4, timeout, bornes
stdout/stderr, résolution bare executable sans shell), service
application + DTO backend + commandes app-tauri, gateway frontend
execTool exposée au runtime plugin — fin des lectures ad hoc du store
interne .git par les plugins.
#347 — onglets projet réordonnables par glisser-déposer (Tabs DnD,
onReorder, persistance de l'ordre via useProjects).
#348 — stop d'agent CLI custom: le message Final vert réapparaît au tour
suivant (override terminal stop armé correctement, reset de
l'interaction, refresh de la délégation requester).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
