chore(#1150): remove rsync from sandbox image by fullsend-ai-coder[bot] · Pull Request #2120 · fullsend-ai/fullsend

fullsend-ai-coder · 2026-06-10T13:36:16Z

PR #761 replaced ssh/scp/rsync with OpenShell native transport (openshell sandbox exec/upload/download), but the Containerfile was not updated. Remove the stale rsync dependency to reduce image size and attack surface.

Changes:

Remove rsync from apt-get install in
images/sandbox/Containerfile
Remove rsync mention from the Containerfile header comment
Update images/README.md tool list to drop rsync
Update images/code/Containerfile base image comment to
list jq instead of rsync

Note: make lint could not run due to Go module cache permission errors in the sandbox (infrastructure issue, not related to this change). No Go code was modified.

Closes #1150

Post-script verification

Branch is not main/master (agent/1150-remove-rsync-from-sandbox)
Secret scan passed (gitleaks — 1281fa9973718b519e2a2404f247cf26baf6521f..HEAD)
Pre-commit hooks passed (authoritative run on runner)
Tests ran inside sandbox

PR #761 replaced ssh/scp/rsync with OpenShell native transport (openshell sandbox exec/upload/download), but the Containerfile was not updated. Remove the stale rsync dependency to reduce image size and attack surface. Changes: - Remove rsync from apt-get install in images/sandbox/Containerfile - Remove rsync mention from the Containerfile header comment - Update images/README.md tool list to drop rsync - Update images/code/Containerfile base image comment to list jq instead of rsync Note: make lint could not run due to Go module cache permission errors in the sandbox (infrastructure issue, not related to this change). No Go code was modified. Closes #1150

github-actions · 2026-06-10T13:37:51Z

Site preview

Preview: https://341e69f8-site.fullsend-ai.workers.dev

Commit: c6bae71698b0a012abb703a9551ee6ce1245bfbf

fullsend-ai-review · 2026-06-10T13:38:02Z

🤖 Finished Review · ✅ Success · Started 1:38 PM UTC · Completed 1:46 PM UTC
Commit: 4ed6da4 · View workflow run →

fullsend-ai-review · 2026-06-10T13:45:55Z

Review

Findings

Low

[stale-reference] hack/patch-fullsend-repo:51 — This script invokes rsync -a --checksum ... to sync scaffold files into a cloned repo. It is a developer host utility (uses gh repo clone, mktemp -d, gh pr create) and never runs inside a sandbox container. Removing rsync from the sandbox image has no impact on this script.
[stale-doc] docs/ADRs/0030-openshell-sandbox-interaction-model.md:143 — ADR 0030 documents the original decision to use rsync for repo extraction. As an ADR (historical record of a point-in-time decision), this is not actively misleading — the ADR's own Consequences section already anticipates the rsync replacement. Optionally add a supersession note referencing PR Replace SSH/SCP/rsync with OpenShell native CLI commands #761.

Info

[stale-doc] docs/ADRs/0030-openshell-sandbox-interaction-model.md:175 — References rsync security filters as protections against sandbox escape vectors. These protections have been migrated to sanitizeDownload() in internal/sandbox/sandbox.go. No action required.

Previous run

Review

Findings

Medium

[stale-doc] docs/architecture.md:595 — Architecture diagram references "rsync repo back (--no-links, exclude .git/hooks/)" as part of the extraction flow. The actual implementation in internal/sandbox/sandbox.go now uses SafeDownload + sanitizeDownload (OpenShell native download). The text is inaccurate.
Remediation: Update line 595 to reflect the current mechanism (e.g., "download repo back (sanitize symlinks, exclude .git/hooks/)" via SafeDownload).

Low

[stale-reference] hack/patch-fullsend-repo:51 — This script invokes rsync -a --checksum ... to sync scaffold files into a cloned repo. This is a developer host utility (uses gh repo clone, mktemp -d, gh pr create) and never runs inside a sandbox container. Removing rsync from the sandbox image has no impact on this script.
[stale-doc] docs/ADRs/0030-openshell-sandbox-interaction-model.md:143 — ADR 0030 documents the original decision to use rsync for repo extraction. As an ADR (historical record of a point-in-time decision), this is not actively misleading — the ADR's own Consequences section already anticipates the rsync replacement. Optionally add a supersession note referencing PR Replace SSH/SCP/rsync with OpenShell native CLI commands #761.

Info

[stale-doc] docs/ADRs/0030-openshell-sandbox-interaction-model.md:175 — References rsync security filters as protections against sandbox escape vectors. These protections have been migrated to sanitizeDownload() in internal/sandbox/sandbox.go. No action required.

ralphbean

LGTM. One non-blocking note inline.

ralphbean · 2026-06-10T21:09:55Z


 # ---------------------------------------------------------------------------
-# Install rsync (for safe repo write-back) and jq (JSON parsing in scripts).
+# Install jq (JSON parsing in agent scripts and skills).


[minor] docs/architecture.md:595 still says "rsync repo back" in the extraction flow diagram. Might be worth updating to reflect SafeDownload while we're here — but not blocking on it.

rh-hemartin · 2026-06-11T14:24:43Z

/fs-fix Fix this "[minor] docs/architecture.md:595 still says "rsync repo back" in the extraction flow diagram. Might be worth updating to reflect SafeDownload while we're here — but not blocking on it."

fullsend-ai-coder · 2026-06-11T14:27:12Z

🤖 Finished Fix · ✅ Success · Started 2:27 PM UTC · Completed 2:31 PM UTC
Commit: 6bfb10b · View workflow run →

Replace stale "rsync repo back" reference with SafeDownload in the architecture diagram's extraction flow, consistent with the OpenShell native transport migration (PR #761). Addresses review feedback on #2120

fullsend-ai-coder · 2026-06-11T14:31:51Z

🔧 Fix agent — iteration 1 (human-triggered)

Updated the extraction flow diagram in docs/architecture.md to replace the stale rsync reference with SafeDownload, consistent with the OpenShell native transport migration.

Fixed (1):

docs/architecture.md:595 still says rsync repo back in extraction flow diagram (docs/architecture.md): Replaced 'rsync repo back (--no-links, exclude .git/hooks/)' with 'SafeDownload repo (sanitize symlinks, strip hooks)' in the extraction flow ASCII diagram, preserving box alignment.

Tests: passed

_{Updated by fullsend fix agent}

fullsend-ai-review · 2026-06-11T14:34:08Z

🤖 Review · Started 2:34 PM UTC
Commit: c6bae71 · View workflow run →

codecov · 2026-06-11T14:35:44Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

fullsend-ai-review · 2026-06-11T14:42:25Z

🤖 Finished Review · ✅ Success · Started 2:34 PM UTC · Completed 2:42 PM UTC
Commit: c6bae71 · View workflow run →

fullsend-ai-retro · 2026-06-12T06:53:31Z

🤖 Finished Retro · ✅ Success · Started 6:53 AM UTC · Completed 6:58 AM UTC
Commit: c6bae71 · View workflow run →

fullsend-ai-retro · 2026-06-12T06:58:15Z

Retro: PR #2120 — Remove rsync from sandbox image

Workflow quality: Good. The code agent produced a clean initial change in ~5 minutes. The review agent correctly identified a stale "rsync" reference in docs/architecture.md:595 that the code agent missed. A human triggered /fs-fix, the fix agent resolved it, and the second review approved. One rework cycle total — the system working as designed.

No new proposals. The single improvement opportunity (code agent should search for all references to a removed term) is already covered by existing open issues:

#1222 — Triage agent: recommend old-value searches for rename/default-change tasks
#1733 — Code agent should proactively update documentation when implementing user-facing features
#1061 — Improve docs-staleness scanning to find all instances in one pass

github-actions Bot deployed to site-preview June 10, 2026 13:37 View deployment

fullsend-ai-review Bot added the requires-manual-review Review requires human judgment label Jun 10, 2026

ralphbean requested a review from maruiz93 June 10, 2026 21:07

ralphbean approved these changes Jun 10, 2026

View reviewed changes

rh-hemartin self-assigned this Jun 11, 2026

docs: update extraction flow diagram to reflect SafeDownload

c6bae71

Replace stale "rsync repo back" reference with SafeDownload in the architecture diagram's extraction flow, consistent with the OpenShell native transport migration (PR #761). Addresses review feedback on #2120

github-actions Bot deployed to site-preview June 11, 2026 14:33 View deployment

fullsend-ai-review Bot approved these changes Jun 11, 2026

View reviewed changes

fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed requires-manual-review Review requires human judgment labels Jun 11, 2026

rh-hemartin added this pull request to the merge queue Jun 12, 2026

Merged via the queue into main with commit 072da72 Jun 12, 2026
12 checks passed

rh-hemartin deleted the agent/1150-remove-rsync-from-sandbox branch June 12, 2026 06:49

qodo-code-review Bot mentioned this pull request Jun 23, 2026

docs: sandbox layout, skill precedence, and agent rule layering #2584

Merged

3 tasks

qodo-code-review Bot mentioned this pull request Jul 29, 2026

fix(#4718)!: remove inline pre-script calls and scaffold script copies #5739

Merged

9 tasks

Uh oh!

Conversation

fullsend-ai-coder Bot commented Jun 10, 2026

Post-script verification

Uh oh!

github-actions Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Site preview

Uh oh!

fullsend-ai-review Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-review Bot commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review

Findings

Low

Info

Review

Findings

Medium

Low

Info

Uh oh!

ralphbean left a comment

Choose a reason for hiding this comment

Uh oh!

ralphbean Jun 10, 2026

Choose a reason for hiding this comment

Uh oh!

rh-hemartin commented Jun 11, 2026

Uh oh!

fullsend-ai-coder Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-coder Bot commented Jun 11, 2026

🔧 Fix agent — iteration 1 (human-triggered)

Uh oh!

fullsend-ai-review Bot commented Jun 11, 2026

Uh oh!

codecov Bot commented Jun 11, 2026

Codecov Report

Uh oh!

fullsend-ai-review Bot commented Jun 11, 2026

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fullsend-ai-retro Bot commented Jun 12, 2026

Retro: PR #2120 — Remove rsync from sandbox image

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 10, 2026 •

edited

Loading

fullsend-ai-review Bot commented Jun 10, 2026 •

edited

Loading

fullsend-ai-coder Bot commented Jun 11, 2026 •

edited

Loading

fullsend-ai-retro Bot commented Jun 12, 2026 •

edited

Loading