Repository navigation
Conversation
…c sandbox. The previous setup meant that running the sandbox and later starting an agent would run the agent without user-authentication.
89be581 to
edb1db6
Compare
philipcraig
left a comment
philipcraig
left a comment
There was a problem hiding this comment.
Mounting every agent's config in the plain shell makes sense for the case in the description. Two side effects look unintended: an agent session now also gets the other agent's credentials, and --offline mounts credentials that nothing in a container without network can use. Keeping main's per-agent _agent_mount_args(agent) and looping over AGENT_CLIS only for the plain shell keeps the fix and avoids both. Details inline.
Blocking: the two credential mounts, on line 279.
Non-blocking: the seeding changes on line 279, the CONTRIBUTING.md wording and the help text below. The suggested change fixes most of them anyway.
Non-blocking: the --skip-permissions help text, which this diff doesn't touch, still names only ~/.claude. ~/.claude.json was already missing from it, and with this PR ~/.gemini is mounted too. With per-agent mounts, "mounts the project, ~/.claude and ~/.claude.json read-write" would be accurate.
| run_args.extend(["--network", "none"]) | ||
|
|
||
| run_args.extend(_agent_mount_args(args.agent)) | ||
| run_args.extend(_agent_mount_args()) |
There was a problem hiding this comment.
Blocking: this mounts all three paths whichever agent is chosen:
claude --skip-permissionsnow runs with~/.gemini, Gemini OAuth tokens included, mounted read-write, with open network and no prompts.agygets~/.claudeand~/.claude.json.--offlinegets every agent's credentials, but with--network noneno agent can authenticate, so the mounts only add exposure. Before this PR the plain shell mounted none, offline or not.
Non-blocking: seeding has moved too. _seed_agent_config() now runs for every agent, before git rev-parse and docker build, so a run that fails still writes ~/.gemini/settings.json (selectedAuthType: oauth-personal), ~/.gemini/trustedFolders.json and an empty ~/.claude.json into the host home. agy and the plain shell now exit when ~/.claude.json is a directory. And with seeding split from mounting, the two functions build the same paths separately, and the mounts are only safe once seeding has run.
Keeping main's _agent_mount_args(agent), which seeds and mounts together, and changing only this call site fixes all of these:
if args.agent is not None:
run_args.extend(_agent_mount_args(args.agent))
elif not args.offline:
for agent in AGENT_CLIS:
run_args.extend(_agent_mount_args(agent))There was a problem hiding this comment.
The aim of this CL is to allow any supported agent to be used from the sandbox. There is no problem to 'fix' here.
| the rest of the host file system, but the network is unrestricted and the | ||
| project and `~/.claude`, credentials included, are mounted read-write. Pass | ||
| `--skip-permissions` only when that is acceptable. | ||
| project and the host config of every supported agent, credentials included, |
There was a problem hiding this comment.
Non-blocking: this paragraph is about claude and --skip-permissions, but readers most need to know that a plain shell now gets every agent's credentials read-write. A sentence under Usage, after "Omit it for a plain shell in the container", would say so. With per-agent mounts this line can go back to naming ~/.claude and ~/.claude.json.
There was a problem hiding this comment.
Why do "readers most need to know that a plain shell now gets every agent's credentials read-write"? The script is called "agentic-sandbox".
Removing per-agent mounts is the point in this CL.
|
@philipcraig pointed out that sharing agent credentials between agents might not be wise. |
Unconditionally seed agent config files and mount them in the agentic sandbox script.
The previous setup meant that running the sandbox and later starting an agent would run the agent without user-authentication.