fix(sandbox): exclude home-dir dotfiles from capture_to artifacts#19
Merged
Conversation
joeysbase
requested review from
akshaylive,
bai-uipath,
tmatup and
uipreliga
as code owners
|
Claude finished @joeysbase's task in 1m 57s —— View job Code Review in Progress
|
Extends test_capture_to_copies_and_tolerates_dangling_symlink to assert that .cache, .config, .npm, .local, .bashrc, .bash_history, .bash_logout, .profile, and .wget-hsts are excluded from captured artifacts. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
click 8.3.1 has a command injection vulnerability in click.edit() (PYSEC-2026-2132, fixed in 8.3.3). Pin click>=8.3.3 explicitly so uv resolves to 8.4.2. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
bai-uipath
approved these changes
Jul 13, 2026
bai-uipath
left a comment
bai-uipath
left a comment
Collaborator
There was a problem hiding this comment.
Fix what you agree with, otherwise lgtm. Correct, focused fix with a narrow blast radius (docker WORKDIR mode only, and the capture runs post-grading so no verdict can change). Denylist is the right shape here — the noise-vs-deliverable distinction isn't mechanically derivable and isn't task-specific, so a curated constant is exactly what should encode it. One real ask before merge (expand it), the rest optional.
- Expand the denylist to the credential family — before merge. The reason
.claudeis excluded is credential-leak prevention, and these captured artifacts get uploaded — but.aws,.ssh,.azure,.netrc,.gitconfig,.dockeraren't covered. If any eval image ships those under/root, they leak into artifacts the same way.credentials.jsonwould have. This PR is the natural place to close that class. Fix: add them to the same tuple insandbox.py:30(worth a quick check of what the images actually put under/rootfirst), and note in the comment that this is a security denylist, not just noise suppression.
Adds .aws, .ssh, .gnupg, .docker, .azure, .netrc, .gitconfig to _WORKSPACE_CAPTURE_IGNORE as a security denylist (defense-in-depth: eval images don't bake credentials, but any image that does must not leak them into uploaded artifacts). Also restructures the comment to distinguish the two exclusion classes: security denylist vs. home-dir noise suppression. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
_WORKSPACE_CAPTURE_IGNOREwas missing common Linux home-directory entries (.cache,.config,.npm,.local, shell dotfiles)working_dir: /root(or any HOME-overlapping path), tools like uv/pip/npm write these into the WORKDIR — andcapture_towas copying all of them verbatim into the artifacts directoryReproduction
Observed with the
skillsbench-court-form-fillingtask (usesworking_dir: /root): artifacts contained.cache/uv/,.config/uv/,.config/coder-eval/,.npm/,.bashrc,.profile,.wget-hstsalongside the intendedsc100-filled.pdf.Test plan
sandbox.docker.working_dir: /rootand confirm artifacts only contain task deliverables🤖 Generated with Claude Code