Fix JSON syntax errors in .devcontainer/devcontainer.json (removed
invalid JS-style // comments) and .devcontainer/opencode.json (removed
90+ trailing commas). Apply auto-fixes for end-of-file and trailing
whitespace issues across 100+ files. Fix SIM105 ruff violations in
benchmarks/core_circuit_breaker_bench.py (use contextlib.suppress).
Note: The security fix from issue #7478 (validate_path startswith bypass)
was already delivered to master in commit e18ac5f2. This PR as currently
structured is non-atomic (35 commits across 10+ issues) and needs
significant restructure before merge. This commit only addresses the
CI/pre-commit failures.
ISSUES CLOSED: #7478
- Remove all # type: ignore[attr-defined] suppressions from step definitions
by using getattr() with explicit type annotations instead of direct
context attribute access
- Fix undefined reference to context.sibling_escape_path by storing the
escape_path value during the prefix collision check
- Remove duplicate 'import os' statements in path_mapper.py
- All quality gates passing (lint, typecheck, unit_tests, integration_tests, e2e_tests)
ISSUES CLOSED: #7478
Remove all # noqa: ANN205 suppressions from container_tool_exec_steps.py
that were applied to already-annotated (-> None) functions, which caused
RUF100 (Unused noqa directive) lint failures. Add the missing Behave step
definitions required by path_containment_security.feature:
- Given a temporary sandbox directory "{path}"
- When I map the host path "{path}" to container
- Then the mapped path should be "{expected}"
Also rename ambiguous "the result should be true/false" steps to
"the host containment result should be true/false" to avoid AmbiguousStep
conflicts with the parametrized step in cli_steps.py.
ISSUES CLOSED: #7478
Replaced insecure str.startswith(root + "/") path containment checks in
tool/path_mapper.py (_is_under) and application/services/llm_actors.py
(_write_to_sandbox) with semantic os.path.relpath comparisons to prevent
sibling-directory prefix-collision path traversal attacks.
The string-prefix approach was vulnerable: a sandbox root of /tmp/sandbox
would incorrectly allow access to /tmp/sandboxmalicious/file.txt because
"/tmp/sandboxmalicious/file" starts with "/tmp/sandbox".
Security specification mandates all path containment checks use
Path.is_relative_to() or equivalent semantic comparison.
Added BDD test coverage in features/path_containment_security.feature
with @tdd_issue_7478 tags for the prefix-collision attack scenarios.
ISSUES CLOSED: #7478
Implement ContainerToolExecutor for delegating tool invocations to
devcontainer environments with full I/O forwarding. Add PathMapper for
bidirectional host/container path translation. Wire container routing
into ToolRunner with graceful fallback when no executor is configured.
Add container_metadata field to ToolInvocation for tracking execution
context.
New modules:
- tool/container_executor.py: ContainerToolExecutor, ContainerConfig,
ContainerMetadata, ContainerExecutionError, ContainerTimeoutError
- tool/path_mapper.py: PathMapper with host_to_container/container_to_host
Modified:
- tool/runner.py: container execution routing via ExecutionEnvironment
- domain/models/core/change.py: container_metadata on ToolInvocation
- tool/__init__.py: new public exports
Review fixes applied:
- Add Alembic migration m6_004 for container_metadata_json column
- Enforce _MAX_OUTPUT_BYTES (50 MiB) truncation in _run_command()
- Fix path traversal in sync_results_to_host (Path.is_relative_to)
- Allow spaces in _looks_like_path() for valid filesystem paths
- Preserve negative exit codes from signal kills in metadata
- Add default=str to json.dumps(invocation.arguments) safety net
- Log warnings when path mapping recursion depth exceeded
- Warn when devcontainer binary not found on PATH
- Use default allow_nan for host-path JSON validation in runner.py
(only container path requires RFC 7159 strict mode)
- Reject URL-like patterns in _looks_like_path() to avoid false
positives on API routes, protocol-relative URIs, and query strings
- Add extract_container_metadata() static helper on
ContainerToolExecutor as bridge for ToolInvocation wiring
- Use raw_stdout bytes in sync_results_to_host to prevent
binary file corruption from text-mode decode/re-encode
- Apply posixpath.normpath() in workspace_folder validator and
reject path components containing '..'
- Check result.timed_out in sync_results_to_host and raise
ContainerTimeoutError instead of always raising ContainerExecutionError
- Detect overlapping host_root/container_root in PathMapper and
raise ValueError to prevent corrupt bidirectional mappings
- Wrap host-side I/O in sync_results_to_host with try/except
OSError to produce ContainerExecutionError on write failure
- Enforce int(timeout) in _build_exec_command to prevent shell
injection via malicious objects with __str__ methods
- Change ToolResult validator from 'not self.error' to
'self.error is None' so empty-string errors are accepted
- Iterate required list directly in ToolRunner schema validation
to detect fields listed in required but absent from properties
Closes#515
HAL9000
OpenCode AI
CoreRasurae
