docs: say what a command meets at a secret #211

Merged

claudiomaradonna merged 1 commit from docs/sandbox-secret-masks into main

2026-11-10 16:19:09 +01:00

motoko commented

2026-11-10 16:17:56 +01:00

Collaborator

Why

A live check of Claude Code's sandbox on Linux, with this source's
settings, showed that a secret file fails more than reads. Writing,
deleting, or renaming one fails with Permission denied or
Device or resource busy, and ls -l shows it as a character device,
which looks like a damaged file. git worktree remove --force on a
worktree that holds one fails after it has deleted the worktree's record
and part of its folder, and the same command then fails outside the
sandbox too. A committed example .env file shows as modified.

The README named refused reads alone, so a developer or an agent who met
any of these had nothing to tell the sandbox's doing from a real fault.
A new item in the retry list was set aside, since that sentence already
lists eleven cases.

What changed

Hooks and settings gains one paragraph after the one on retries. The
README said that the sandbox refuses the secret files; it now also says
that on Linux each is a device file to a command that starts while it
exists, what reading, writing, deleting, and renaming it report, and
that a file a command creates stays readable until that command ends.

It says what a failed git worktree remove --force leaves behind, and
that rm -rf outside the sandbox removes the rest.

It says that a committed example .env file shows as modified in
git status inside the sandbox, with what git diff and a checkout
report there.

The skills that remove a worktree stay as they are.

How to verify

On Linux, in a Claude Code session on a repository with these settings,
have Claude run a command that creates .env in a git-ignored folder,
then a second command that runs cat and rm on it. cat reports
Permission denied and rm reports Device or resource busy, as the
paragraph says, and the rm passes when retried outside the sandbox.

Checks on the tip, all passed: bash tests/verify-agent-config.sh, 245
tests outside the sandbox; bash tests/check-work-folder.sh;
.agents/hooks/shellcheck.sh repo; prettier --check '**/*.md';
scripts/verify-agent-config.sh; git diff --check main. The change
adds no test. macOS and WSL2 were not tried, so the text speaks of Linux
alone.

Considerations

The paragraph adds about a hundred words to a section already longer
than a document section aims for. A review finding that asked the
paragraph to repeat "run it outside the sandbox" was set aside, since
the retry paragraph before it says so for every failed command.

## Why A live check of Claude Code's sandbox on Linux, with this source's settings, showed that a secret file fails more than reads. Writing, deleting, or renaming one fails with `Permission denied` or `Device or resource busy`, and `ls -l` shows it as a character device, which looks like a damaged file. `git worktree remove --force` on a worktree that holds one fails after it has deleted the worktree's record and part of its folder, and the same command then fails outside the sandbox too. A committed example `.env` file shows as modified. The README named refused reads alone, so a developer or an agent who met any of these had nothing to tell the sandbox's doing from a real fault. A new item in the retry list was set aside, since that sentence already lists eleven cases. ## What changed Hooks and settings gains one paragraph after the one on retries. The README said that the sandbox refuses the secret files; it now also says that on Linux each is a device file to a command that starts while it exists, what reading, writing, deleting, and renaming it report, and that a file a command creates stays readable until that command ends. It says what a failed `git worktree remove --force` leaves behind, and that `rm -rf` outside the sandbox removes the rest. It says that a committed example `.env` file shows as modified in `git status` inside the sandbox, with what `git diff` and a checkout report there. The skills that remove a worktree stay as they are. ## How to verify On Linux, in a Claude Code session on a repository with these settings, have Claude run a command that creates `.env` in a git-ignored folder, then a second command that runs `cat` and `rm` on it. `cat` reports `Permission denied` and `rm` reports `Device or resource busy`, as the paragraph says, and the `rm` passes when retried outside the sandbox. Checks on the tip, all passed: `bash tests/verify-agent-config.sh`, 245 tests outside the sandbox; `bash tests/check-work-folder.sh`; `.agents/hooks/shellcheck.sh repo`; `prettier --check '**/*.md'`; `scripts/verify-agent-config.sh`; `git diff --check main`. The change adds no test. macOS and WSL2 were not tried, so the text speaks of Linux alone. ## Considerations The paragraph adds about a hundred words to a section already longer than a document section aims for. A review finding that asked the paragraph to repeat "run it outside the sandbox" was set aside, since the retry paragraph before it says so for every failed command.

motoko added 1 commit

2026-11-10 16:18:01 +01:00

docs: say what a command meets at a secret

Maintenance / checks (pull_request) Successful in 4m39s

Details

Maintenance / checks (push) Successful in 3m53s

Details

30377524ad

Inside Claude Code's sandbox on Linux a secret file is a device file to
each command, so writing, deleting, or renaming one fails, a worktree
that holds one is removed only in part, and a committed example file
shows as modified. The README named refused reads alone, which left
these failures looking like damage to the files.

claudiomaradonna merged commit 30377524ad into main

2026-11-10 16:19:09 +01:00

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

claudiomaradonna/agent-foundry!211

No description provided.

Rows
Columns