Repository navigation
fix(config): confine discovered bridge.toml to its own directory - #16
Merged
Merged
Conversation
A bridge.toml found by upward discovery was trusted as operator policy and replaced the user config, so a cloned repository could commit one with allowed_roots = ["/"] and a workspace-write default to authorize Codex outside the project. - Discovered (project-local) files may only list allowed_roots that resolve inside the directory holding the file, and on POSIX must be owned by the current user and not world-writable. - allowed_roots are resolved once at startup and never re-resolved per call, so a symlink created after startup cannot redirect a root. - init applies the same confinement when checking an existing project-local file, and doctor reports the confinement. - Explicit --config files and the user config stay unconfined.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bridge.tomlfound by upward discovery from the launch directory is now treated as project-local. It took precedence over the user config, yet a cloned repository could commit one that authorized workspaces anywhere (for exampleallowed_roots = ["/"]with aworkspace-writedefault).allowed_rootsthat resolve inside the directory holding the file. On POSIX the file must also be owned by the current user and not world-writable; group-writable files stay accepted for umask 002 setups. Violations fail startup withCONFIG_KEY_DENIED.allowed_rootsare resolved once at startup, for every config source, andPolicyStore.check_workspaceno longer re-resolves them per call. Before, a symlink created after startup, for example by aworkspace-writeturn, could redirect a root outside the configured path. This also covers the resume path.initapplies the same confinement when it checks an existing project-local file, anddoctorreports the confinement.--configfiles and the user config stay unconfined.docs/configuration.md,docs/security.md,docs/testing.md, andCHANGELOG.md..omc/(local tool state).Behavior changes
--config PATHfor such setups. The user config is still not read while a project-local file exists.Residual risk (accepted)
workspace-write, through a committedbridge.toml.Validation
uv run --frozen pytest -m 'not live' -q: 160 passed, 4 deselecteduv run --frozen ruff check src testsandruff format --check src tests: cleanuv build: OKpolicy.pychange is reverted, and passes with it.aquais not installed, so I used uv 0.12.23 instead of the pinned 0.12.13, with the same frozenuv.lock;betterleaks; and live tests.Evidence is fake, unit, and subprocess only. There is no live-runtime or real-application validation.