fix: introduce AbsolutePathBuf as part of sandbox config #7856
+277
−122
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bolinfest
force-pushed
the
pr7856
branch
11 times, most recently
from
10b4572 to
e566a32
Compare
bolinfest
requested review from
gt-oai,
gverma-openai,
jif-oai and
pakrym-oai
bolinfest
force-pushed
the
pr7856
branch
3 times, most recently
from
9c2d4e4 to
d39d29f
Compare
pakrym-oai
reviewed
Dec 12, 2025
|
|
||
| #[test] | ||
| fn serialize_workspace_write_environment_context() { | ||
| let cwd = if cfg!(windows) { "C:\\repo" } else { "/repo" }; |
Collaborator
There was a problem hiding this comment.
I wonder if we need path helpers. Some of these don't actually need to be real.
test_path_does_not_matter("/repo")
test_path_tmp()
etc.
Would be a shame to embed cfg!(windows) into so many places to get all tests to work for windows.
pakrym-oai
reviewed
Dec 12, 2025
| roots.push(tmpdir_path); | ||
| } else { | ||
| error!( | ||
| "Ignoring invalid TMPDIR value {tmpdir:?} for sandbox writable root", |
Collaborator
There was a problem hiding this comment.
nit maybe include error
pakrym-oai
approved these changes
Dec 12, 2025
Collaborator
Author
|
@pakrym-oai good points: I'll try to address in a follow-up before this PR starts incurring hard-to-fix merge conflicts! |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Changes the
writable_rootsfield of theWorkspaceWritevariant of theSandboxPolicyenum fromVec<PathBuf>toVec<AbsolutePathBuf>. This is helpful because now callers can be sure the value is an absolute path rather than a relative one. (Though when using an absolute path in a Seatbelt config policy, we still have to canonicalize it first.)Because
writable_rootscan be read from a config file, it is important that we are able to resolve relative paths properly using the parent folder of the config file as the base path.