feat(#3996): gate workspace-escaping generated-media paths behind user confirmation - #4026
Draft
aheritier wants to merge 2 commits into
Draft
feat(#3996): gate workspace-escaping generated-media paths behind user confirmation#4026aheritier wants to merge 2 commits into
aheritier wants to merge 2 commits into
Conversation
aheritier
added
area/cli
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
August 24, 2026 15:13
9b6e49d to
8e76a13
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
August 25, 2026 08:00
8e76a13 to
871dd1e
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
2 times, most recently
from
August 25, 2026 08:32
e76fa5b to
0fe2b64
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
August 25, 2026 20:24
0fe2b64 to
d6b3c12
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
August 26, 2026 11:09
d6b3c12 to
9a926c1
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
2 times, most recently
from
September 1, 2026 16:10
426aea6 to
9a926c1
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 1, 2026 16:30
9a926c1 to
c442c63
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 1, 2026 19:58
c442c63 to
161aaa6
Compare
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 6, 2026 16:14
161aaa6 to
5b26f97
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 7, 2026 11:19
5b26f97 to
ffb1c83
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 7, 2026 11:34
ffb1c83 to
b9f0d13
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 7, 2026 16:13
b9f0d13 to
5ab1ac5
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 7, 2026 16:47
5ab1ac5 to
f5cc603
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 8, 2026 06:17
f5cc603 to
32b0b74
Compare
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 8, 2026 07:57
32b0b74 to
94da09d
Compare
Classify absolute, parent-traversing, and home-relative requested paths and require an explicit affirmative MediaEscapeDecisionSchema choice via runtime elicitation before writing externally. Keep the workspace option first and default; empty or free-form submissions never grant permission. Expand existing directory targets to a MIME-corrected filename before confirmation. Publish with the same O_EXCL, collision-suffix, and atomic mechanics as workspace files, and persist the actual final absolute path with ArtifactRootExternal in the manifest. An ordinary file collision may select a suffixed sibling; a directory appearing at the confirmed file path is rejected instead of selecting a different sibling. Decline and cancellation redirect toward a sanitized workspace basename with a safe warning; subsequent writes can still fail. Explicitly noninteractive runtimes/sessions and the A2A path decline automatically. Foreground no-sink callers, including ACP, are not covered by that policy and can wait until context cancellation; this patch does not fix ACP. The non-JSON CLI declines the form and continues draining events so the warning, response, and persisted turn are retained. RequestedPath supplies the internal naming input; provider display names retain generic fallback.
After successful workspace materialization and manifest recording, store the bytes under the owning session and final artifact identity. Add the SQLite blob table as migration 029 and place the manifest root-kind migration at 030. The workspace deliverable remains available at its requested or collision-adjusted path; the session copy enables portable resolution without embedding generated base64 in session JSON. Blob writes are all-or-error without a per-item byte cap. A failed blob write preserves the workspace file and emits a safe portability warning. DeleteSession removes both manifest and blob rows. The in-memory store mirrors add, lookup, defensive copying, overwrite, and cleanup semantics.
aheritier
force-pushed
the
workspace-media-escape-confirm
branch
from
September 8, 2026 17:31
94da09d to
69f32a6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Requires user confirmation before generated-media paths escape the workspace, including classification, CLI/runtime flow, session manifests, and TUI schema coverage.
Why
Prevents generated files from silently writing outside the configured workspace.
Validation
task test; workspace-media, runtime escape, CLI, session, and TUI tests.Test instructions
Run:
task testRequest generated-media output whose destination is outside the configured workspace. Expected: the operation asks for confirmation; approving writes to the requested destination, while denying it performs no outside-workspace write and reports the denial safely.