[fismif]

What it does

Fixes #155 (follow-up to #147). Adds per-path exceptions to the sensitive-mount guard. Homeshell workstreams, dotfiles repos, and ~/.m2 no longer need the blanket --allow-sensitive-mounts.

• --add-sensitive-dir <path> and --add-readonly-sensitive-dir <path> work like --add-dir and --add-readonly-dir, plus a one-run exception for <path>. They are repeatable and CLI-only, and they add to config add_dirs instead of replacing it.

• sensitive_dir_exceptions lists exempted paths and mounts nothing.

  • It is read from global config and global tool_overrides only. Project config drops it with a warning.
  • Entries that are empty, relative, or home or one of its parents are ignored with a warning.

• An exception covers its path and everything below it, after symlink resolution. Every exempted mount warns on start.

• --add-sensitive-dir <project> exempts the project without mounting it twice; Homeshell relies on this. The read-only flag on the project exits 1 and points at --project-mount readonly.

• No exception covers:

  • home and its parents
  • Enclave's own roots, which would let the agent widen its own exceptions or add host commands
  • $SSH_AUTH_SOCK

  Only the blanket opt-in, which is unchanged, gets past these.

• Worktree metadata and devcontainer binds stay exception-free.

Departures from the agreed design:

• Config entries that don't exist yet resolve through their nearest existing parent, so they work under a symlinked ~/.local.
• The home refusal says "no sensitive-dir exception can cover" instead of "home and its parents cannot be exempted".
• New helpers mounts.ResolveExtraDir and app.resolveAdditionalMounts.
• The website configuration page is updated.

How to test

make test covers the scenarios. Manually, with a throwaway HOME:

mkdir -p ~/.local/share/homeshell/workstreams/demo && cd "$_" && git init
enclave run --background                                       # refused: is inside ~/.local
enclave run --background --add-sensitive-dir "$PWD"            # starts, one warning, project mounted once
enclave run --background --add-readonly-sensitive-dir "$PWD"   # exit 1 before the image build

With "sensitive_dir_exceptions": ["~/.cache"] set, --add-dir ~/.cache/pip starts, but --add-dir ~/.cache is refused because it contains ~/.cache/enclave.

Build, tests, lint, and the license check pass, and the refusal paths were checked against the built binary. Session starts are not verified yet, because Docker isn't installed locally.

Follow-ups

• Honor explicit boolean flag values and reject invalid ones #132: --allow-sensitive-mounts=false still opts in. The new flags are not affected.
• Homeshell: pass --add-sensitive-dir for its workstream directories.

Breaking changes

None. The flags and the config key are new, enclave config gains three keys, and the refusal wording changes.

• This PR introduces breaking changes and has been coordinated with maintainers.

Review checklist

• As an author, I have thoroughly tested my changes and carefully followed the contribution guidelines.

[fismif]

@EclipseSourceAI

[EclipseSourceAI]

Note

Autonomous AI review.

This review was done by an AI agent and therefore may contain mistakes. Feel free to ignore any comment you disagree with. A thumbs-down reaction on a comment marks it as rejected for follow-up reviews. Noting why in a reply helps, since replies are read too.

Resolving all AI comments does not lead to an automatic approval. A maintainer still needs to review and sign off on the overall architecture and design.

To get an updated review after pushing changes, a maintainer may re-request a review from this account.

Running in Eclipse Enclave, submitted via review-guard-mcp

This PR adds per-path exceptions to the sensitive-mount guard. There are two new CLI-only flags, --add-sensitive-dir and --add-readonly-sensitive-dir, which mount a path and exempt it for one run. A new sensitive_dir_exceptions key, read only from global config and global tool_overrides, exempts paths on every run without mounting them. mounts.SensitivePaths gains Assess and a "hard" flag on protected locations. Home and its parents, Enclave's own roots (now passed separately through config.HostEnclaveRoots) and $SSH_AUTH_SOCK can never be exempted. Only --allow-sensitive-mounts gets past them.

Where a maintainer should look:

• Security boundary: project config drops sensitive_dir_exceptions in applyProjectDefaultsGuardrails. Config entries that are home or a parent of it are rejected. Hard protection is checked against all locations, not just the first match. I checked the main paths here (symlinked home, tool_overrides source, a CLI exception on home) and found no bypass.
• Refusal message: see the inline comment. The new footer recommends --add-sensitive-dir even for hard-protected offenders, including the common "ran from ~" case.
• Docs: the cli-reference claim that the flags behave "exactly like --add-dir" is wrong for the project-dir read-only case.

go vet and go test pass for mounts, app, config, cli and model. A test merge against current main conflicts only in docs/ARCHITECTURE.md, and the conflict looks trivial. All other overlapping files merge cleanly.

[github-actions]

🚀 Deployed preview to https://eclipse-enclave.github.io/enclave-website-previews/pr-previews/pr-162/

[fismif]

@EclipseSourceAI

[EclipseSourceAI]

Note

Autonomous AI review.

This review was done by an AI agent and therefore may contain mistakes. Feel free to ignore any comment you disagree with. A thumbs-down reaction on a comment marks it as rejected for follow-up reviews. Noting why in a reply helps, since replies are read too.

Resolving all AI comments does not lead to an automatic approval. A maintainer still needs to review and sign off on the overall architecture and design.

To get an updated review after pushing changes, a maintainer may re-request a review from this account.

Running in Eclipse Enclave, submitted via review-guard-mcp

Follow-up review. Since my last pass, two commits (3e859e6, bcb1f88) directly address both points I raised: the refusal footer now reports HardReason for hard-protected offenders and only suggests exceptions when at least one offender is actually exemptable, and the cli-reference wording no longer claims the new flags behave "exactly like" --add-dir/--add-readonly-dir. Both come with new test cases (mount_guard_test.go) covering the home-project, Enclave-root, and mixed hard/exemptable scenarios. The rest of the merge commit (9bd49bd) is just a clean merge of unrelated upstream commits with a trivial conflict resolution in mount_guard.go/cli-reference.md/options_def.go; no new logic there. Build, go vet, and the relevant test packages (app, mounts, config) all pass. No new issues found in the changes since my last review.

These previous comments can be resolved as they are now handled:

• refusal footer now reports hard-protected reasons and only suggests exceptions when applicable
• cli-reference no longer overclaims the flags behave "exactly like" --add-dir

I can't resolve them myself as I would need write permission on this repository.

[tortmayr]

@fismif Needs a rebase