fix(shell): allow unjailed fs in shipped config so release publish boots - #117
Conversation
The release workflow boots the prebuilt iii-shell from shell/ to collect its function interface. The shipped shell/config.yaml had host_root: null and allow_unjailed: false, which trips validate_fs_jail() and exits before registration, failing every shell publish run (e.g. 25688635094). Flip allow_unjailed to true in the shipped config. The Rust default remains fail-closed for the "no config file" path.
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughA single configuration value is changed: ChangesFilesystem Configuration
🎯 1 (Trivial) | ⏱️ ~2 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
skill-check — worker6 verified, 20 skipped (no docs/).
Three for three. Nicely done. |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@shell/config.yaml`:
- Around line 74-75: The shipped config exposes the full filesystem by setting
allow_unjailed: true with host_root: null; change this to a safe default
host_root (e.g., "/tmp" or "/var/lib/iii-shell" or your workspace dir) and/or
set allow_unjailed: false so the shell remains jailed by default; update the
config keys host_root and allow_unjailed accordingly and document the chosen
safe path so CI still passes but deployments are protected.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
Previous commit set allow_unjailed: true with host_root: null, which satisfied the safety check but exposed the entire host filesystem to shell::fs::* (subject only to the advisory denylist). Set host_root: /tmp and restore allow_unjailed: false. /tmp exists on every Unix host (Ubuntu CI runners, macOS via /private/tmp), is writable, and contains only ephemeral data. Operators should override this with their actual workspace path.
2 participants
Summary
The release publish workflow (run 25688635094) was failing at the "Start local worker for interface collection" step. The prebuilt
iii-shellexited within 2s with:Root cause: the shipped
shell/config.yamlhadhost_root: null+allow_unjailed: false, which tripsvalidate_fs_jail()(shell/src/config.rs:170) before the worker can register its functions with the engine.iii-databaseworks because its config has no equivalent safety gate.Fix: jail to
/tmpinstead of opening the host filesystem.host_root: /tmp— exists on every Unix host (Ubuntu CI runners, macOS via/private/tmp), writable, ephemeral-only.allow_unjailed: false— stays the safe default.Operators should override
host_rootwith the workspace they actually intend the shell worker to manage. The RustDefault::default()(shell/src/config.rs:111) remains fail-closed for the "no config file" path.(First commit on this branch set
allow_unjailed: truewithhost_root: null, which satisfied the gate but exposed the entire host filesystem. That's now corrected by the follow-up commit.)Test plan
cargo test -p iii-shell --lib config::passes locally (15/15).shell/v0.3.3) and confirm theStart local workerstep boots andPOST /publishreturns HTTP 200.