Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

fix: require explicit workdir command cwd

Browse Source
This commit is contained in:
Hare
2026-09-24 20:17:19 +09:00
parent 4c653a939f
commit 1e4fcd170c
11 changed files with 131 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/workdir/src/external.rs
+1 -1
View File
@@ -534,7 +534,7 @@ mod tests {
command: "cat /home/operator/private/session.log".to_string(),
timeout_secs: 1,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: Some("/home/operator/private/output".into()),
tool_call_id: None,
});
crates/workdir/src/external_local_tests.rs
+1 -1
View File
@@ -62,7 +62,7 @@ async fn external_local_provider_is_strictly_read_only() {
command: "echo changed > item.txt".to_string(),
timeout_secs: 1,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
crates/workdir/src/local.rs
+39 -20
View File
@@ -1192,18 +1192,13 @@ impl WorkdirSession for LocalWorkdirSession {
{
return Err(WorkdirError::OutOfScope(spill_dir.to_path_buf()));
}
let cwd = if let Some(logical_cwd) = request.cwd.as_ref() {
let cwd = self.resolve(logical_cwd);
let scope = self.inner.scope.snapshot();
if !scope.is_readable(&cwd)
|| !std::fs::metadata(&cwd).is_ok_and(|metadata| metadata.is_dir())
{
return Err(WorkdirError::OutOfScope(cwd));
}
cwd
} else {
self.inner.cwd.clone()
};
let cwd = self.resolve(&request.cwd);
let scope = self.inner.scope.snapshot();
if !scope.is_readable(&cwd)
|| !std::fs::metadata(&cwd).is_ok_and(|metadata| metadata.is_dir())
{
return Err(WorkdirError::OutOfScope(cwd));
}
let id = self.inner.next_command_id.fetch_add(1, Ordering::Relaxed);
let handle = CommandHandle(format!("command-{id}"));
let (completion_tx, completion) = watch::channel(false);
@@ -2080,7 +2075,7 @@ mod tests {
command: "sleep 30".to_owned(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
@@ -2777,7 +2772,7 @@ mod tests {
command: "pwd && printf provider-command".into(),
timeout_secs: 5,
output_limit: 4096,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
@@ -2866,6 +2861,30 @@ mod tests {
assert!(grep.output.contains("FINAL-NEEDLE"));
}
#[tokio::test]
async fn command_rejects_explicit_cwd_outside_attachment_scope() {
let dir = TempDir::new().unwrap();
let outside = TempDir::new().unwrap();
let workdir = make_fs(&dir);
let cwd = WorkdirPath::new_scoped(outside.path().display().to_string()).unwrap();
let error = WorkdirSession::start_command(
&workdir,
CommandRequest {
command: "printf hidden".into(),
timeout_secs: 5,
output_limit: 1024,
cwd,
spill_dir: None,
tool_call_id: None,
},
)
.await
.unwrap_err();
assert!(matches!(error, WorkdirError::OutOfScope(path) if path == outside.path()));
}
#[tokio::test]
async fn command_rejects_spill_directory_without_read_scope() {
let dir = TempDir::new().unwrap();
@@ -2878,7 +2897,7 @@ mod tests {
command: "printf hidden".into(),
timeout_secs: 5,
output_limit: 1,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: Some(spill.path().to_path_buf()),
tool_call_id: None,
},
@@ -2918,7 +2937,7 @@ mod tests {
command: "i=0; while [ $i -lt 200 ]; do printf 'line-%03d\\n' \"$i\"; i=$((i+1)); done; printf 'FINAL-NEEDLE\\n'".into(),
timeout_secs: 5,
output_limit: 64,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: Some(spill.path().to_path_buf()),
tool_call_id: None,
},
@@ -2965,7 +2984,7 @@ mod tests {
command: "printf 'aéz'".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
@@ -3191,7 +3210,7 @@ mod tests {
command: "printf ready; printf warning >&2; sleep 0.2; printf done".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: Some("tool-7".into()),
},
@@ -3296,7 +3315,7 @@ mod tests {
command: "sleep 30".into(),
timeout_secs: 1,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
@@ -3367,7 +3386,7 @@ mod tests {
command: "sleep 30".into(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
},
crates/workdir/src/operation.rs
+1 -2
View File
@@ -16,8 +16,7 @@ pub struct CommandRequest {
pub output_limit: usize,
/// Workdir-relative command directory. Providers validate it against the
/// active session before process start.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub cwd: Option<fs_operation::FsPath>,
pub cwd: fs_operation::FsPath,
/// Provider-local directory where complete output is retained when the
/// inline result exceeds `output_limit`.
pub spill_dir: Option<PathBuf>,
crates/workdir/src/router.rs
+3 -3
View File
@@ -718,7 +718,7 @@ mod tests {
command: "printf done".to_string(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: crate::WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
})
@@ -752,7 +752,7 @@ mod tests {
command: "sleep 30".to_string(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: crate::WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
})
@@ -779,7 +779,7 @@ mod tests {
command: "sleep 30".to_string(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: crate::WorkdirPath::root(),
spill_dir: None,
tool_call_id: None,
})
crates/workdir/src/scope.rs
+12 -15
View File
@@ -1094,10 +1094,7 @@ impl WorkdirSession for ScopedWorkdirSession {
}
let tool_call_id = request.tool_call_id.clone();
if self.scope.is_some() {
request.cwd = Some(match request.cwd.as_ref() {
Some(cwd) => self.resolve_path(cwd)?,
None => self.cwd.clone(),
});
request.cwd = self.resolve_path(&request.cwd)?;
}
if let Some(tool_call_id) = &tool_call_id {
self.starting_tool_calls
@@ -1677,7 +1674,7 @@ mod tests {
command: command.into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some(tool_call_id.into()),
})
@@ -1706,7 +1703,7 @@ mod tests {
command: "printf ready; sleep 0.2; printf done".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("tool-delegated".into()),
})
@@ -1773,7 +1770,7 @@ mod tests {
command: "pwd".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: None,
})
@@ -1805,7 +1802,7 @@ mod tests {
command: "pwd; sleep 0.2".into(),
timeout_secs: 5,
output_limit: 4096,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("first-command".into()),
})
@@ -1907,7 +1904,7 @@ mod tests {
command: "printf denied".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("read-only-command".into()),
})
@@ -2213,7 +2210,7 @@ mod tests {
command: "printf revoked".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("revoked-child-command".into()),
})
@@ -2315,7 +2312,7 @@ mod tests {
command: "sleep 30".into(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some(format!("command-{index}")),
})
@@ -2328,7 +2325,7 @@ mod tests {
command: "sleep 30".into(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("command-over-limit".into()),
})
@@ -2362,7 +2359,7 @@ mod tests {
command: "sleep 30".into(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("racing-command".into()),
})
@@ -2408,7 +2405,7 @@ mod tests {
command: "sleep 30; printf leaked > marker".into(),
timeout_secs: 60,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("owned-command".into()),
})
@@ -2603,7 +2600,7 @@ mod tests {
command: "printf closed".into(),
timeout_secs: 5,
output_limit: 1024,
cwd: None,
cwd: FsPath::root(),
spill_dir: None,
tool_call_id: Some("closed-parent-command".into()),
})