From 36ae1a4cba791ec633a81b38b1d8345af8487276 Mon Sep 17 00:00:00 2001 From: tanaka takashi Date: Thu, 13 Aug 2026 19:15:01 +0900 Subject: feat!: unify sandbox configuration and permission application Replace the split executable approval and sandbox resolution workflows with schema_version 2 and a YAML-driven execution.entries model. Resolve workspace, mount, executable, runtime, network, and resource settings into one config-scoped Applied Configuration snapshot protected by a user-only DACL and written with atomic replacement. Reduce the public CLI to implicit server startup, show, and apply. Remove serve/check, executable and sandbox subcommands, and configuration override flags including --config, --lang, --transport, --path, and --runtime-root. Add migration diagnostics for every removed schema and command surface, and keep server preflight mandatory for both stdio and HTTP. Update effective-policy compilation to validate the applied fingerprint, resolved paths, and executable hashes before startup. Preserve fail-closed behavior while allowing execution entries and runtime roots inside a development workspace to inherit that workspace capability without creating an impossible narrower ACL boundary. Rewrite the README around the consolidated permission matrix and document configuration, application, store location, startup, transport-specific elevation, Python 3.14, PowerShell, and cmd usage. Align specifications, design, implementation plan, traceability, audit report, localization, publish scripts, and operational verification with the breaking schema. Verification: Release build completed with zero warnings and errors; Agent.Core.Tests 104/104 and Agent.Planner.Tests 10/10 passed; administrator Windows Security/Recovery 56/56 and README operational 19/19 passed with no skips; published HTTP MCP completed a cmd/curl/venv-Python task with network deny and zero ACL, WFP, journal, backup, or process residue. --- tests/Agent.Windows.Tests/SecurityPolicyTests.cs | 32 ++++++++++++------------ 1 file changed, 16 insertions(+), 16 deletions(-) (limited to 'tests/Agent.Windows.Tests/SecurityPolicyTests.cs') diff --git a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs index d0c32a8..6dbc9ab 100644 --- a/tests/Agent.Windows.Tests/SecurityPolicyTests.cs +++ b/tests/Agent.Windows.Tests/SecurityPolicyTests.cs @@ -17,19 +17,20 @@ namespace Agent.Windows.Tests; public sealed class SecurityPolicyTests { [Fact] - public void Approval_store_uses_atomic_replace_and_a_user_only_dacl() + public void Applied_configuration_store_uses_atomic_replace_and_a_user_only_dacl() { using TestDirectory directory = new(); - string storePath = Path.Combine(directory.Path, "protected", "executable-approvals.json"); - var store = new ExecutableApprovalStore(storePath); - string executable = Environment.ProcessPath!; - store.Approve(new("self", "executable", executable, executable, - EntryExecutablePolicy.ComputeSha256(executable), null, DateTimeOffset.UtcNow)); - - Assert.Single(store.List()); - Assert.Empty(Directory.EnumerateFiles(Path.GetDirectoryName(storePath)!, "*.tmp")); + string configPath = Path.Combine(directory.Path, "agent.yaml"); + File.WriteAllText(configPath, "schema_version: 2"); + string storeRoot = Path.Combine(directory.Path, "protected"); + var store = new AppliedConfigurationStore(configPath, storeRoot); + store.Save(new(2, Path.GetFullPath(configPath), new string('A', 64), [], [], + new("none", []), new("normal", 4096, 16, 1800), DateTimeOffset.UtcNow)); + + Assert.NotNull(store.Load()); + Assert.Empty(Directory.EnumerateFiles(storeRoot, "*.tmp")); DirectorySecurity security = FileSystemAclExtensions.GetAccessControl( - new DirectoryInfo(Path.GetDirectoryName(storePath)!), AccessControlSections.Access); + new DirectoryInfo(storeRoot), AccessControlSections.Access); Assert.True(security.AreAccessRulesProtected); using var identity = System.Security.Principal.WindowsIdentity.GetCurrent(); var rules = security.GetAccessRules(true, false, typeof(System.Security.Principal.SecurityIdentifier)) @@ -147,23 +148,22 @@ public sealed class SecurityPolicyTests Directory.CreateDirectory(secondTarget); CreateJunction(junctionPath, firstTarget); string configPath = Path.Combine(directory.Path, "agent.yaml"); - File.WriteAllText(configPath, "schema_version: 1"); + File.WriteAllText(configPath, "schema_version: 2"); string stores = Path.Combine(directory.Path, "stores"); var configuration = new AgentConfiguration { Sandbox = new SandboxOptions { Profile = "development", Workspaces = [junctionPath] } }; - var resolver = new SandboxEnvironmentResolver(configPath, configuration, - new SandboxResolutionStore(configPath, stores, protectDirectory: false), - new ExecutableApprovalStore(Path.Combine(stores, "approvals.json"), protectDirectory: false)); - _ = resolver.Confirm(); + var resolver = new AppliedSandboxConfiguration(configPath, configuration, + new AppliedConfigurationStore(configPath, stores, protectDirectory: false)); + _ = resolver.Apply(); Directory.Delete(junctionPath); CreateJunction(junctionPath, secondTarget); ConfigurationException error = Assert.Throws(() => resolver.Compile( Path.Combine(directory.Path, "journals"), Path.Combine(directory.Path, "backups"))); - Assert.Equal("sandbox.resolution_changed", error.Code); + Assert.Equal("sandbox.configuration_not_applied", error.Code); Directory.Delete(junctionPath); } -- cgit v1.2.3