Merge pull request #23 from A3S-Lab/fix/srt-nested-write-denies-6.3.1

fix(sandbox): avoid nested deny mount failures

Author: ZhiXiao-Lin

CHANGELOG.md

@@ -7,6 +7,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.3.1] - 2026-07-22
+
+### Fixed
+
+- Removed redundant nested SRT write-deny mounts when a protected workspace
+  ancestor already blocks writes, while retaining credential read denial and
+  standalone sensitive-file write protection.
+
 ## [6.3.0] - 2026-07-22
 
 ### Added

Cargo.lock

@@ -317,10 +317,12 @@ language/bootstrap injection variables. It keeps stdout and stderr distinct
 under one global capture limit. Its deadline covers output draining and the
 child's complete lifetime, including a process that closes both streams before
 it exits; timeout or cancellation terminates the Unix process group. It never
- searches `PATH` for a sandbox runtime and never falls back to the host runner
- when its explicitly provisioned runtime is missing or fails. The embedding host
- remains responsible for choosing whether an unavailable sandbox causes an
- interactive escalation or a deterministic denial.
+searches `PATH` for a sandbox runtime and never falls back to the host runner
+when its explicitly provisioned runtime is missing or fails. Write-deny paths
+already covered by a protected ancestor are collapsed before SRT startup,
+while more-specific credential read denies remain intact. The embedding host
+remains responsible for choosing whether an unavailable sandbox causes an
+interactive escalation or a deterministic denial.
 
 Shell isolation does not automatically govern in-process workspace tools.
 Interactive hosts should construct `LocalWorkspaceBackend` or

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-core"
-version = "6.3.0"
+version = "6.3.1"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"

core/Cargo.toml

@@ -132,7 +132,7 @@ impl SrtBashSandbox {
         deny_read.extend(read_denied_roots());
         let mut allow_read = readable_tool_paths(&self.workspace, scratch);
         deny_write.extend(sensitive_paths.iter().cloned());
-        deduplicate_paths(&mut deny_write);
+        remove_redundant_deny_write_descendants(&mut deny_write);
         deduplicate_paths(&mut sensitive_paths);
         deduplicate_paths(&mut deny_read);
         deduplicate_paths(&mut allow_read);
@@ -1047,6 +1047,16 @@ fn deduplicate_paths(paths: &mut Vec<PathBuf>) {
     paths.dedup();
 }
 
+fn remove_redundant_deny_write_descendants(paths: &mut Vec<PathBuf>) {
+    deduplicate_paths(paths);
+    let candidates = paths.clone();
+    paths.retain(|path| {
+        !candidates
+            .iter()
+            .any(|ancestor| ancestor != path && path.starts_with(ancestor))
+    });
+}
+
 fn path_strings<'a>(paths: impl IntoIterator<Item = &'a Path>) -> Vec<String> {
     paths
         .into_iter()

core/src/sandbox/srt.rs

@@ -98,7 +98,22 @@ async fn adapter_passes_argv_workspace_timeout_env_and_settings() {
         .as_array()
         .unwrap()
         .iter()
-        .any(|path| path.as_str().unwrap().ends_with("/.codex/auth.json")));
+        .any(|path| path
+            == &json!(workspace
+                .path()
+                .canonicalize()
+                .unwrap()
+                .join(".codex/auth.json"))));
+    assert!(settings["filesystem"]["denyRead"]
+        .as_array()
+        .unwrap()
+        .iter()
+        .any(|path| path
+            == &json!(workspace
+                .path()
+                .canonicalize()
+                .unwrap()
+                .join(".a3s/os-auth.json"))));
     assert!(settings["filesystem"]["denyRead"]
         .as_array()
         .unwrap()
@@ -114,11 +129,29 @@ async fn adapter_passes_argv_workspace_timeout_env_and_settings() {
                 .canonicalize()
                 .unwrap()
                 .join("services/api/.env"))));
+    assert!(
+        !settings["filesystem"]["denyWrite"]
+            .as_array()
+            .unwrap()
+            .iter()
+            .any(|path| path
+                == &json!(workspace
+                    .path()
+                    .canonicalize()
+                    .unwrap()
+                    .join(".a3s/os-auth.json"))),
+        "a protected parent directory must cover sensitive descendants without a nested mount"
+    );
     assert!(settings["filesystem"]["denyWrite"]
         .as_array()
         .unwrap()
         .iter()
-        .any(|path| path.as_str().unwrap().ends_with("/.codex/auth.json")));
+        .any(|path| path
+            == &json!(workspace
+                .path()
+                .canonicalize()
+                .unwrap()
+                .join("services/api/.env"))));
     assert_eq!(settings["enableWeakerNestedSandbox"], false);
     assert_eq!(settings["allowAppleEvents"], false);
 }

core/src/sandbox/srt/tests.rs

@@ -200,10 +200,10 @@ impl Tool for BashTool {
             }
         };
         if require_escalated
-            && !args
+            && args
                 .get("justification")
                 .and_then(serde_json::Value::as_str)
-                .is_some_and(|value| !value.trim().is_empty())
+                .is_none_or(|value| value.trim().is_empty())
         {
             return Ok(ToolOutput::error(
                 "justification is required when sandbox_permissions is require_escalated",

core/src/tools/builtin/bash.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-code-node"
-version = "6.3.0"
+version = "6.3.1"
 edition = "2021"
 authors = ["A3S Lab Team"]
 license = "MIT"
@@ -11,7 +11,7 @@ description = "A3S Code Node.js bindings - Native addon via napi-rs"
 crate-type = ["cdylib"]
 
 [dependencies]
-a3s-code-core = { version = "6.3.0", path = "../../core", features = ["s3", "serve"] }
+a3s-code-core = { version = "6.3.1", path = "../../core", features = ["s3", "serve"] }
 napi = { version = "2", features = ["async", "napi6", "serde-json"] }
 napi-derive = "2"
 tokio = { version = "1.35", features = ["full"] }