Repository navigation
Temporarily disable OS sandboxing; default to full-access - #2
Merged
Merged
Conversation
…TUI (7df-lab#196) * feat(protocol): add provider catalog types and reasoning normalize Introduce providers.json catalog types, drop provider_vendor, and normalize reasoning effort aliases to on/off for adapters. * feat(config): migrate providers.json catalog and connections Add catalog/migration/runtime modules, connection persistence, and legacy model_bindings migration onto provider/model overlays. * feat(core): resolve turns from provider/model catalog Replace model_binding/preset paths with catalog-backed selection, provider request maps, and updated conversation/query fixtures. * feat(provider): catalog-aware routing and wire API updates Update OpenAI/Anthropic adapters and router for provider/model selection; include related safety/mcp clippy cleanups. * feat(server): provider discover/upsert and catalog turn routing Wire provider APIs, discovery, session model resolution, and e2e tests onto provider/model catalog selections. * feat(cli,tui): adopt provider/model selection and onboarding Update prompt/doctor routing, client surfaces, and TUI onboarding to the catalog Connection contract. * feat(desktop): provider settings, logos, and chat polish Ship Desktop Connection settings, provider logos, migration helpers, SDK wiring, and chat streaming/error UX for the catalog model. * docs: refresh provider/model docs and enable CI clippy Update configuration docs/specs/READMEs for providers.json and uncomment workspace clippy in GitHub Actions. * fix(clippy): use ? in bash command parse loop Unblocks workspace clippy on Linux CI after re-enabling -D warnings. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(clippy): drop needless return in linux bwrap helper Linux-only clippy path failed CI after re-enabling -D warnings. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(clippy): prefer sort_by_key for catalog priority order Matches newer clippy unnecessary_sort_by on CI rustc 1.98. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(clippy): silence rustc 1.98 lints across sandbox consumers Box large rollback Errs and apply checked_div / Option::filter / useless_conversion / question_mark cleanups so CI stable clippy passes. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(ci): box CommitAttemptFailure and rustfmt tool_state for stable clippy EOF Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
Propagate cancellation through exec and MCP calls, clean up stdio process trees on Unix and Windows, and resolve the esaxx-rs LIBCMT linker conflict for the bundled code-search MCP binary. Includes regression tests and documentation.
…d diffs Ship path-scoped workspace changes with expandable MultiFileDiff context (file sides + git patch as visual source of truth), durable turn recovery across desktop/TUI/server, and related review panel UX. Co-authored-by: Cursor <cursoragent@cursor.com>
Recovery Available for Failed turns was short-circuiting post-turn scheduling and skipping the goal pause path, leaving Active goals after 400s. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
feat: durable turn recovery, workspace Changes review, and git-aligned diffs
Co-authored-by: Cursor <cursoragent@cursor.com>
chore: release v0.1.39
…lab#201) Cancel/abort the active turn before persisting recovery on shutdown, trim crash-tail bytes before append, and treat truncated+blank JSONL as final so restart hydration no longer fails closed on the queue-drain race. Co-authored-by: Cursor <cursoragent@cursor.com>
…n_limit (7df-lab#202) * fix(desktop): render compaction markers inline in process timeline Keep Compacting/Compacted at chronological arrival order among tools and reasoning instead of pinning them below the turn actions. Co-authored-by: Cursor <cursoragent@cursor.com> * fix(desktop): show progressive tool verbs instead of generic tool labels Map native tool names in the SDK and align Desktop titles with Running/Grepping-style verbs. Co-authored-by: Cursor <cursoragent@cursor.com> * chore: remove ignored legacy compaction_token_limit plumbing Drop the unused config field and call-site plumbing; compaction limits stay model-derived from the effective context window. Co-authored-by: Cursor <cursoragent@cursor.com> * style: rustfmt after compaction_token_limit removal Co-authored-by: Cursor <cursoragent@cursor.com> --------- Co-authored-by: Cursor <cursoragent@cursor.com>
…pport (7df-lab#206) * feat: consolidate Devo workspace improvements * chore: remove .cursor files
…urn-cancellation fix(runtime): register queued turns for cancellation
…goal-context fix(goal): refresh context after in-flight goal changes
…ython-interrupt fix(server): retain goal resume while an interrupted turn finishes
…t-dispatch fix(server): bound incoming RPC future storage
* fix(server): bound incoming RPC future storage * fix(tests): build stdio fixtures in the selected profile * fix(tests): retain the physical target cache for fixture builds
…nt-identity fix(server): preserve nested agent paths on restore
chore(release): v0.2.12
* fix(cli): dispatch RLM shell requests in headless prompts * fix(cli): keep detached Linux prompts fenced and reject invalid model overrides
chore: release v0.2.14
resolvePrimeInferencePostLoginModelAction is a debrand stub that returns undefined; the caller dereferenced action.openModelPicker unconditionally and crashed the post-login jump. Resolve the action first and treat a missing openModelPicker as a no-op. Co-Authored-By: Claude Code <noreply@anthropic.com>
Source builds pass a bare interpreter name ("python"), which fails with
ENOENT on hosts without a python alias. fallback_interpreter now scans
PATH for python/python3 on Unix (Windows keeps "python"), the kernel
spawn reports the interpreter path on ENOENT, and doctor probes with
the same fallback.
Co-Authored-By: Claude Code <noreply@anthropic.com>
The secret-free tmux job completes a real turn (T2) against a local mock provider (smoke-mock-provider.mjs, openai/anthropic/responses wires) so fork PRs get turn coverage. The repo-owned tmux-live job seeds one home per wire API: DeepSeek chat completions, DeepSeek anthropic-messages (same key), and optional OpenAI responses, plus the T3 interrupt scenario, on ubuntu and macOS. Cleanup retries are best-effort so an ENOTEMPTY race never fails a passing run. Co-Authored-By: Claude Code <noreply@anthropic.com>
SANDBOX_ENFORCEMENT_TEMPORARILY_DISABLED is read at the three spawn decision points (tool router, server terminals, RLM kernel fence), so every process runs with full user permissions regardless of the session's configured, persisted, or live-updated profile. The kernel Plan-mode fence gates relax accordingly; the enforcement machinery itself stays compiled and covered by its direct tests. Flip the const to false to re-enable. Co-Authored-By: Claude Code <noreply@anthropic.com>
While OS sandboxing is temporarily disabled, new sessions default to the full-access preset so tool calls run uninterrupted (yolo + allow_network); the approval pipeline itself is unchanged. Explicit project permission_preset config still wins. child_approval_routing pins its session back to "default" because it exercises interactive approval routing. Co-Authored-By: Claude Code <noreply@anthropic.com>
PERMISSIONS_COMMAND_ENABLED gates the builtin command's autocomplete and dispatch (status message instead of the selector) and the connection-layer slash intercept that runs first in the product binary. The handler, selector component, parser, and read/updatePermissionProfile APIs stay compiled for the revert and for the --dangerously-skip-permissions CLI path. Co-Authored-By: Claude Code <noreply@anthropic.com>
…ccess PERMISSION_PICKER_ENABLED gates both composer-footer picker renders; state, stash, and persistence wiring stay in place so the source-string contract tests keep passing. The composer default flips to fullAccess to match the server's new-session default while the sandbox is disabled (Desktop pushes this value on launch). Co-Authored-By: Claude Code <noreply@anthropic.com>
Banner on the sandbox/permissions docs, the user guide, the dev checks page, and the README pointing at the three enable constants and the default-preset literals. Co-Authored-By: Claude Code <noreply@anthropic.com>
Skip-gate the Plan-fence and SANDBOX_DENIED retry-ladder tests behind SANDBOX_ENFORCEMENT_TEMPORARILY_DISABLED (kept for the post-revert contract), pin interactive-approval tests back to a asking preset, and update fresh-session default assertions (mode currentValue, redundant fullAccess prelude) to the new full-access start. Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Code <noreply@anthropic.com>
The secrets context is not available in step-level if expressions, so the workflow failed to compose on GitHub (0-second workflow file error). Mirror the job env value instead, which actionlint accepts. Co-Authored-By: Claude Code <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The OS-sandbox mechanisms are not yet mature. This PR disables them
repo-wide on Windows/Linux/macOS and runs every process with full user
permissions, while hiding the permission-profile UI. Everything is
gated on named constants for a one-flip revert:
SANDBOX_ENFORCEMENT_TEMPORARILY_DISABLED(crates/sandbox/src/lib.rs),read at the three spawn decision points: tool router, server
terminals, RLM kernel fence. Kernel Plan-mode fence gates relax
accordingly; the enforcement machinery itself stays compiled and
covered by its direct tests.
pipeline code untouched; explicit project
permission_presetconfig still wins).
/permissionsis hidden in the TUI(
PERMISSIONS_COMMAND_ENABLED, both the interactive builtin andthe connection-layer intercept) and the desktop composer picker is
hidden (
PERMISSION_PICKER_ENABLED, default flips to fullAccess tomatch the server). Protocol and
--dangerously-skip-permissionspaths are unchanged.
Also rides along (previously reviewed work): the openModelPicker
post-login crash fix, the bare-
pythonPATH fallback for kernelspawns, and the tmux smoke mock-provider + three-wire live LLM CI jobs.
Notes
are skip-gated behind the switch and return with the revert.
(listed in the docs banner).
🤖 Generated with Claude Code