| Filename | Latest commit message | Latest commit date |
|---|---|---|
9451ebfb24
The knowledge repo is cloned with credentials embedded in .git/config; those credentials survive on disk and the entire LOCAL_DIR (including .git/) is bind-mounted read-only into every agent container. Any agent (or prompt-injected PR build) can read the site-admin token via cat /knowledge/.git/config. Defense-in-depth layer: in write_nspawn_flags, append --tmpfs=/knowledge/.git after the --bind-ro=.../knowledge flag whenever the /knowledge bind mount is present. systemd-nspawn processes the tmpfs after the bind, overlaying an empty in-memory directory over .git/ inside the container. Agents see the working-tree documents but not the repo metadata or stored credentials. This is independent of the complementary fix in workers/knowledge.rs (stop embedding credentials in .git/config in the first place). Both layers together provide defense-in-depth: even if a future credential accidentally reaches .git/config, it stays off the container floor. Closes part of issue 2308 (bind-mount isolation layer). |
||
| .. | ||
| src | ||
| Cargo.toml | ||