# agent: Re-enable sandbox \(\#61711\) ยท gitcafe/zed [View on GitCafe](https://git.cafe/gitcafe/zed/commit/12a19dccef81f85fa2ca07aee37499f659ed0942) Repository: [gitcafe/zed](https://git.cafe/gitcafe/zed) Visibility: public Requested revision: 12a19dccef81f85fa2ca07aee37499f659ed0942 Requested commit: 12a19dccef81f85fa2ca07aee37499f659ed0942 Commit: 12a19dccef81f85fa2ca07aee37499f659ed0942 Tree: 8e1fa291952a79b93d61674941459605c2775265 Author: Cameron Mcloughlin Committer: GitHub ## Message ``` agent: Re-enable sandbox (#61711) Fixes the bug that made us remove the sandbox. The bug in question was very dumb: - there is sophisticated machinery for detecting whether a user-granted writable path is swapped out for a symlink in the timing gap between approval and sandbox creation - there was no equivalent machinery to do the same for the (much larger) gap between a user *persisting an approval* (either for the current thread or permanently via settings) - The fix is essentially to store canonical (i.e. absolute and symlink-free at all depths) paths as the source of truth, but retain the raw path for display purposes - On WSL, there is extra care needed becasue of the bidirectional mounting (i.e. `/mnt/c/...` and `\\wsl.localhost\Ubuntu\...`). In particular, `/mnt/c/...` paths, since their inodes do not necessarily pin NTFS file references, weaken the sandbox guarantees, and so we need some extra UI to call this out and docs etc... This also does not remove the feature flag, but just toggles it to "enabled_for_all" --- Release Notes: - N/A or Added/Fixed/Improved ... --------- Co-authored-by: Richard Feldman Co-authored-by: Jakub Konka Co-authored-by: Danilo Leal Co-authored-by: zed-zippy[bot] <234243425+zed-zippy[bot]@users.noreply.github.com> ``` ## Parents - [b005c0de6728c65db431520647b2fb5c2887e14f](https://git.cafe/gitcafe/zed/commit/b005c0de6728c65db431520647b2fb5c2887e14f?format=markdown) [Source at this commit](https://git.cafe/gitcafe/zed/tree/12a19dccef81f85fa2ca07aee37499f659ed0942?format=markdown)