Repository navigation
fix(windows): 沙盒准备时跳过无权读取的 PATH 条目 - #405
Merged
shanyuhai123 merged 2 commits intoOct 21, 2026
Merged
Conversation
沙盒准备会对 PATH 中的每个目录做 realpath，但只容忍目录不存在（ENOENT、ENOTDIR）。 遇到当前用户无权读取的目录（例如位于其他用户配置目录下的 PATH 条目）会抛出 EPERM， 导致整个沙盒准备失败，第一条命令还没执行就返回“runtime request failed”。 现在对 PATH 条目逐个处理，遇到 EPERM 或 EACCES 的条目直接跳过：这类目录既无法被授权， 也无法被搜索。仅跳过 PATH 条目，shell、系统与搜索目录，以及受保护和敏感路径出错时仍然失败。 新增两个测试：无权读取的 PATH 条目被跳过；无权读取的必要目录仍然失败。 Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Contributor
Author
|
这个要拉一下，我被这个沙盒问题，折磨了一下午 |
Contributor
|
优化了下候选检查过程 ... |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
背景与关联 / Context and related issue
host.sandbox.prepare）会对 PATH 中的每个目录做realpath，但只容忍目录不存在（ENOENT、ENOTDIR）。遇到当前用户无权读取的目录时会抛出EPERM，整个沙盒准备随之失败，第一条命令还没执行就返回 “runtime request failed”。我们在“安装包后用标准用户验证沙盒”的验收里复现了：验证用的标准用户读不了另一个用户配置目录下的 PATH 条目C:\Users\runneradmin\setup-pnpm\node_modules\.bin\bin，沙盒准备因此失败。该行为随 fix(buddy): 重构 Windows 沙盒并简化权限策略 #395（重构 Windows 沙盒）引入。主要改动 / Changes
createWindowsSandboxPolicy对 PATH 条目逐个处理，遇到EPERM或EACCES的条目直接跳过，因为这类目录既无法被授权，也无法被搜索。仅跳过 PATH 条目：shell、系统、搜索目录，以及受保护和敏感路径出错时仍然失败，不放宽安全边界。新增两个测试：无权读取的 PATH 条目被跳过；无权读取的必要目录仍然失败。验证 / Verification
sandboxPolicy.spec.ts5 个用例通过，类型检查与 lint 通过；用同一改动重新跑“安装包 + 标准用户沙盒验证”，Windows x64 与 arm64 均通过（修复前两个架构都在这一步失败）。本分支未在本地重复运行，交由 CI 验证。兼容与风险 / Compatibility and risks
不适用 / N/A。只影响沙盒准备时对 PATH 的处理：当前用户读不了的 PATH 目录不再出现在沙盒的搜索路径与授权里；其余路径的错误处理不变。
界面变更 / UI changes
不适用 / N/A。
🤖 Generated with Claude Code