From 3ed5854a62913b3835e846efbccb1325dd75d9ba Mon Sep 17 00:00:00 2001 From: CleverThis Date: Fri, 10 Apr 2026 19:37:25 +0000 Subject: [PATCH] docs(spec): clarify sandbox cleanup must re-discover directories on each scan Bug #7443 found that CleanupService._get_sandbox_dirs() permanently caches the list of sandbox directories from the first scan. Since the cleanup service is a long-running singleton, sandboxes created after the first scan are never discovered and never cleaned up. Added 'Sandbox cleanup re-discovery contract' to the Sandbox Security Invariants section clarifying that: - The cleanup service MUST re-discover sandbox directories on each scan/purge - It MUST NOT cache the directory list across invocations - Sandbox directories are created dynamically during plan execution - Permanent caching causes stale sandbox accumulation Refs: bug #7443 (CleanupService stale sandbox directory cache) --- docs/specification.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/docs/specification.md b/docs/specification.md index dbe7bd381..e6e5d7b96 100644 --- a/docs/specification.md +++ b/docs/specification.md @@ -46205,6 +46205,8 @@ The sandbox is the primary safety mechanism preventing untested changes from rea 3. **Atomic apply**: The Apply phase is an atomic operation — either all sandbox changes are committed to the real resources, or none are. For git-based resources, this uses git merge. For database resources, this uses transaction commit. 4. **Sandbox cleanup**: Sandbox directories are cleaned up according to `sandbox.cleanup` policy. Sensitive data (API responses, LLM outputs) is purged from the sandbox on cleanup. +**Sandbox cleanup re-discovery contract**: The cleanup service MUST re-discover sandbox directories on each scan or purge operation — it MUST NOT cache the directory list across invocations. Sandbox directories are created dynamically during plan execution; a cache populated at service initialization time will miss all sandboxes created after the first scan. The cleanup service is typically a long-running singleton, so permanent caching would cause stale sandbox accumulation even when the cleanup service is actively running. Each `scan()` and `purge()` call must perform a fresh filesystem scan of the sandbox root directory. + #### Prompt Injection Mitigation In server mode, where user-provided content may flow into LLM prompts, CleverAgents implements several mitigations: -- 2.52.0