docs(security): align sandbox boundary claims - #4065
Conversation
Generated-by: Codex
Astro-Han
left a comment
Astro-Han
left a comment
There was a problem hiding this comment.
Thanks for correcting the stale sandbox documentation and adding Runtime Host composition evidence. The overall direction is right, the new test stays at the relevant composition boundary, and the current hosted checks are green.
I found one remaining accuracy issue in the Windows coverage matrix and left it inline. I’m holding approval until that wording matches the implementation; I did not find a need for additional production abstractions or test removal.
Review analysis was assisted by Codex; Astro-Han reviewed the result and owns this review.
简体中文
谢谢修正过时的 sandbox 文档，并在 Runtime Host 组合边界补充验证。整体方向正确，新增测试也放在了合适的组合层；当前 GitHub checks 均已通过。
Windows 覆盖表仍有一处与实现不完全一致的问题，我已经留在行内。这里修正前先不 Approve；除此之外，不需要增加新的生产抽象，也没有应删除的测试。
本次审查分析由 Codex 协助；Astro-Han 审阅了结果并对本次 Review 负责。
| | ----------------------------------------------------------------------------------- | --------------------------------------------------------- | --------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | | ||
| | Agent Bash, foreground or background without a PTY | Seatbelt | bubblewrap | Restricted managed execution fails closed because the AppContainer broker cannot launch an arbitrary shell | Runs through the detected host shell | | ||
| | Agent Bash with a PTY | Refused when the active profile requires sandboxing | Refused when the active profile requires sandboxing | Refused when the active profile requires sandboxing | Runs as a host PTY | | ||
| | Local-path `Read`, `Write`, `Edit`, `FormatJson`, `Glob`, `Grep`, and `apply_patch` | Filesystem worker under Seatbelt | Filesystem worker under bubblewrap | Purpose-built filesystem worker under the AppContainer broker | Managed execution uses the worker without an OS sandbox; bypass uses the host-local executor; external uses the injected executor | |
There was a problem hiding this comment.
Thanks for tightening this matrix. [P2] This Windows cell currently presents Read, Write, Edit, FormatJson, Glob, Grep, and apply_patch as covered by the AppContainer filesystem worker. The implementation returns grep_unavailable for Grep; missing-target Write and apply_patch create/delete also fail closed because their parent-entry authority cannot currently be represented. Since this PR is specifically making the security-boundary claims exact, could you split the Windows coverage or explicitly list these unsupported shapes?
简体中文
谢谢把这张覆盖表补得更准确。[P2] 当前 Windows 单元格会让人理解为 Read、Write、Edit、FormatJson、Glob、Grep 和 apply_patch 都由 AppContainer filesystem worker 支持。但实际实现会对 Grep 返回 grep_unavailable；缺失目标的 Write 以及 apply_patch 的创建、删除操作，也会因为当前无法表达 parent-entry authority 而 fail closed。这个 PR 的目的正是让安全边界描述准确，建议拆分 Windows 覆盖项，或明确列出这些不支持的操作形态。
2 participants
Summary
Fixes #4063
Verification
npm --workspace @maka/core run buildnpm --workspace @maka/storage run buildnpm --workspace @maka/runtime run buildnpm --workspace @maka/runtime-host run buildnode --test --test-name-pattern='production Host executes current-boundary Bash and refreshes live sandbox context' packages/runtime-host/dist/__tests__/execution-model-composition.test.js— 1 pass, 0 failnode --test packages/runtime/dist/__tests__/macos-seatbelt-smoke.test.js packages/runtime/dist/__tests__/filesystem-worker-smoke.test.js— 11 pass, 0 failnpm --workspace @maka/runtime-host test— 1307 pass, 9 skip, 0 failnpm run format:checknpx biome lint packages/runtime-host/src/__tests__/execution-model-composition.test.tsnpm run check:asf-headersgit diff --checkSecurity
This changes documentation and regression evidence only; runtime behavior is unchanged. The policy claim is limited to restricted managed non-PTY Bash and filesystem-worker surfaces supported by each platform. It does not claim containment for bypass, unrestricted, disabled, external, managed PTY, or client integrated-terminal execution.
AI use
Select exactly one:
Tool(s) and scope: Codex investigated the Runtime Host sandbox wiring, drafted the security documentation changes, and authored the focused product-composition regression coverage. The commit includes the required
Generated-by: Codextrailer.Checklist
The new test characterizes already-shipped Runtime Host enforcement because the defect is stale documentation, not missing runtime behavior; there is no production-code change to make it fail on the base commit.
Does this PR entail a change in behavior?