Ting/workflows
Watch
2
0
Fork
You've already forked workflows
 0
Code Issues 28 Pull requests Projects Releases Packages Wiki Activity Actions

feat(sandbox): sensitive path masking for .dsh-run and DSH_HOME #17

New issue
Open
opened 2026-09-09 10:15:32 +00:00 by larandar · 0 comments
larandar commented 2026-09-09 10:15:32 +00:00
Owner
Copy link

Proposal

Explicitly mask DSH port state and DSH_HOME inside the sandbox.

Design

Mask .dsh-run and DSH_HOME through the mount plan while retaining approved workspace access.

Tasks

  • Identify sensitive paths; add inaccessible masks; verify workspace remains available.

Gherkin Specification Delta

must.contracts.ting-workflows.deliverable-17

Scenario: Deliverable behavior

  • GIVEN the stated prerequisites and inputs
  • WHEN the feature is exercised
  • THEN a sandbox run, when it accesses .dsh-run or DSH_HOME, then the path is inaccessible.
## Proposal Explicitly mask DSH port state and DSH_HOME inside the sandbox. ## Design Mask .dsh-run and DSH_HOME through the mount plan while retaining approved workspace access. ## Tasks - Identify sensitive paths; add inaccessible masks; verify workspace remains available. ## Gherkin Specification Delta ### must.contracts.ting-workflows.deliverable-17 **Scenario: Deliverable behavior** - **GIVEN** the stated prerequisites and inputs - **WHEN** the feature is exercised - **THEN** a sandbox run, when it accesses .dsh-run or DSH_HOME, then the path is inaccessible.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
fastlane
tango/2-ting-workflow-executor
No results found.
Labels
Clear labels
  
Compat/Breaking
Breaking change that won't be backward compatible

  
Kind/Bug
Something is not working

  
Kind/Documentation
Documentation changes

  
Kind/Enhancement
Improve existing functionality

  
Kind/Feature
New functionality

  
Kind/Security
This is security issue

  
Kind/Testing
Issue or pull request related to testing

  
Meta/Campaign
Campaign grouping node; dependencies name its direct Epics

  
Meta/Epic
Epic grouping node; dependencies name its direct Sessions

  
Meta/Session
Session delivery bundle; dependencies name its direct leaf issues

  
Priority/Critical
The priority is critical

  
Priority/High
The priority is high

  
Priority/Low
The priority is low

  
Priority/Medium
The priority is medium

  
Reviewed/Confirmed
Issue has been confirmed

  
Reviewed/Curated
PR LABEL: merge by rebase/ff to preserve the commit line; absence means squash. Set by the AUTHOR. (Curation itself is a duty on every PR — the label only picks the merge style.)

  
Reviewed/Duplicate
This issue or pull request already exists

  
Reviewed/Invalid
Invalid issue

  
Reviewed/Won't Fix
This issue won't be fixed

  
Scope/Campaign
Umbrella issue grouping a coherent multi-issue campaign.

  
Status/Abandoned
Somebody has started to work on this but abandoned work

  
Status/Blocked
Something is blocking this issue or pull request

  
Status/Conflicted
STATE: steward rebase failed; work returned to its agent, with evidence.

  
Status/In Progress
STATE: claimed, workspace active. Exactly one assignee, or none when idle.

  
Status/In Review
STATE: PR open against fastlane. Set by steward (PR webhook).

  
Status/Need Grooming
Issue body and comments do not yet conform to the Deliverable record; grooming required.

  
Status/Need More Info
Feedback is required to reproduce issue or to continue work

  
Status/Ready
Ready for execution; no known blocker prevents useful work from starting.

No labels
Compat/Breaking
Kind/Bug
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Meta/Campaign
Meta/Epic
Meta/Session
Priority/Critical
Priority/High
Priority/Low
Priority/Medium
Reviewed/Confirmed
Reviewed/Curated
Reviewed/Duplicate
Reviewed/Invalid
Reviewed/Won't Fix
Scope/Campaign
Status/Abandoned
Status/Blocked
Status/Conflicted
Status/In Progress
Status/In Review
Status/Need Grooming
Status/Need More Info
Status/Ready
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Blocks
#2 Session: ting-workflow-executor — embedded Nushell, bwrap sandboxing, and OWS DSL 1.0
Ting/workflows
Depends on
#16 feat(sandbox): probed NixOS mount table builder
Ting/workflows
Reference
Ting/workflows#17
No description provided.