From 84d5cf5048a64a261eeb9d05546aa84b58ecc3ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9=20Padez?= Date: Sun, 8 Mar 2026 07:50:33 +0000 Subject: [PATCH] =?UTF-8?q?fix=20sandbox=20HOME=20resolution=20=E2=80=94?= =?UTF-8?q?=20capture=20at=20module=20load=20before=20user-instance=20over?= =?UTF-8?q?rides=20it?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Opus 4.6 --- src/servers/sidecar/sandbox.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/servers/sidecar/sandbox.ts b/src/servers/sidecar/sandbox.ts index 50cd2384..a394de67 100644 --- a/src/servers/sidecar/sandbox.ts +++ b/src/servers/sidecar/sandbox.ts @@ -10,6 +10,7 @@ const BUN_DIR = (() => { const PROJECT_ROOT = resolve(import.meta.dir, '../../..'); const DATA_PATH = process.env.DATA_PATH ?? join(process.cwd(), 'data'); +const HOST_HOME = process.env.HOME!; // Resolve the OS username for runuser to drop privileges inside the sandbox const OS_USERNAME = (() => { @@ -72,7 +73,7 @@ export function buildSandboxPrefix(email: string): string[] { // Ensure intermediate dirs under HOME are traversable after runuser drops privileges // (bwrap auto-creates them as root-owned drwx------) - const homeDir = process.env.HOME!; + const homeDir = HOST_HOME; args.push('--perms', '0755', '--dir', homeDir); // Bun runtime (e.g. /home/pastilhas/.bun)