Why: The sandbox tier wrote the session directory directly, so a buggy
or runaway script could leave the workspace half-mutated and nothing
bounded what a timeout had already written. The plan's first landing
shape (section 4.4) swaps the session bind for a frozen-base overlay:
each exec freezes the session dir (hardlink clone + sha256 baseline),
runs on a private upper, and only a clean exit promotes the change set
back via CAS (baseline hash match -> atomic replace/remove; externally
changed targets double-store as *.conflict-* instead of clobbering).
Timeouts and kills discard the upper entirely - half-written state
never lands.
Evidence: go test ./... green including bwrap integration roundtrips
(TestSandboxWorkspaceOverlayRoundtrip: add/modify/delete through a real
overlayfs upper with whiteout handling and ws cleanup;
TestSandboxWorkspaceOverlayTimeoutDiscards: partial writes discarded on
timeout) and unit anchors for freeze manifest (.agentx excluded), CAS
add/modify, conflict double-store, and the change summary.
Impact: Opt-in via --exec-workspace overlay / AGENT_SYSTEM_EXEC_WORKSPACE
(only with --exec-backend sandbox; fail-closed on unknown modes). The
model sees a one-line change summary appended to the tool output, so
discards and conflict files are visible. Default behavior is unchanged.
Refs: proposal 2026-10-10-agent-delegation-routing-sandbox.md section
4.4; Dev task feature/agent-s0-workspace-overlay.
weichen
merged commit 0c34b3595e into main2026-10-11 02:14:36 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
S0 首个落地形态（提案 §4.4）：sandbox 档会话目录由直写改为冻结基底 overlay——执行期写隔离（超时/中止整体丢弃，半写状态不落地）；正常退出按变更集 CAS 写回（基线哈希一致才替换/删除，外部已改则双存 .conflict-）；工具输出追加一行变更摘要。
入口：--exec-workspace overlay / AGENT_SYSTEM_EXEC_WORKSPACE（仅 sandbox 后端，缺省行为不变）。
Evidence: go test ./... 全绿，含两个真实 bwrap 集成（overlay 往返含 whiteout 删除、超时丢弃）与四个单测锚点。
Refs: Dev 任务 feature/agent-s0-workspace-overlay。