(magpie) branch main updated: fix(sandbox): deny agent edits to the vetted-ops policy (#1308)

[po...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/magpie.git


The following commit(s) were added to refs/heads/main by this push:
     new 47a76463 fix(sandbox): deny agent edits to the vetted-ops policy (#1308)
47a76463 is described below

commit 47a7646326be888367b30f79ea869f02c99565f6
Author: Jarek Potiuk <ja...@potiuk.com>
AuthorDate: Mon Sep 21 03:38:14 2026 +0200

    fix(sandbox): deny agent edits to the vetted-ops policy (#1308)
    
    The dispatcher's policy decides which caller may run which operation, so
    an agent able to rewrite it can grant itself the whole catalogue. The
    deny rules `setup-isolated-setup-update` checks for were never present in
    the framework's own dogfooded settings.
    
    Covers both surfaces the policy resolves to: the committed
    `.apache-magpie-overrides/tools/vetted-ops/` override and the
    `magpie-vetted-ops` plugin cache. The in-repo `tools/vetted-ops/` source
    is deliberately not denied — it is the framework's own code, gated by PR
    review, and a write-deny there makes the tree read-only to every
    sandboxed subprocess including `prek`'s fixers.
    
    Keeps `tools/sandbox-lint/expected.json` in step with the live settings.
    
    Generated-by: Claude Opus 5
---
 .claude/settings.json            | 4 ++++
 tools/sandbox-lint/expected.json | 4 ++++
 2 files changed, 8 insertions(+)

diff --git a/.claude/settings.json b/.claude/settings.json
index 6e621752..61b09465 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -120,6 +120,10 @@
       "Read(//**/.env.*.local)",
       "Edit(.claude/settings.json)",
       "Edit(.claude/settings.local.json)",
+      "Edit(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Write(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
+      "Write(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
       "Bash(curl *)",
       "Bash(wget *)",
       "Bash(aws *)",
diff --git a/tools/sandbox-lint/expected.json b/tools/sandbox-lint/expected.json
index 6e621752..61b09465 100644
--- a/tools/sandbox-lint/expected.json
+++ b/tools/sandbox-lint/expected.json
@@ -120,6 +120,10 @@
       "Read(//**/.env.*.local)",
       "Edit(.claude/settings.json)",
       "Edit(.claude/settings.local.json)",
+      "Edit(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Write(.apache-magpie-overrides/tools/vetted-ops/**)",
+      "Edit(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
+      "Write(~/.claude/plugins/cache/apache-magpie/magpie-vetted-ops/**)",
       "Bash(curl *)",
       "Bash(wget *)",
       "Bash(aws *)",