claude-code - 💡(How to fix) Fix [FEATURE] sandbox.filesystem needs metadata-only (traverse-only) path grants [2 comments, 2 participants]

TL;DR

Implementing a separate sandbox.filesystem.allowReadMetadata configuration option is likely the most straightforward fix to achieve metadata-only path grants.

Guidance

• Introduce a new configuration option allowReadMetadata to differentiate between read access and metadata-only access, allowing for more fine-grained control over file system permissions.
• Update the logic for handling allowRead and denyRead entries to respect the new allowReadMetadata option, ensuring that metadata-only grants do not override deny rules.
• Test the new configuration option with various scenarios, including the use case of running sandboxed git in ~/git/ repos, to verify that it achieves the desired behavior without exposing sensitive files.
• Consider adding documentation to clarify the differences between allowRead and allowReadMetadata to help users understand how to use these options effectively.

Example

// Example configuration snippet
sandbox.filesystem = {
  allowReadMetadata: ["/Users/mikeowens"], // Allows traversal without exposing subtree contents
  allowRead: ["/Users/mikeowens/public"], // Allows full read access to specific subtrees
  denyRead: ["~"] // Denies read access to the home directory
}

Notes

The proposed solution assumes that the underlying file system and sandboxing mechanisms support distinguishing between metadata-only access and full read access. The implementation details may vary depending on the specific technologies and frameworks used.

Recommendation

Apply the workaround by implementing the allowReadMetadata configuration option, as it directly addresses the issue of needing metadata-only path grants without exposing sensitive files.