fix(sandbox): make UnixLocal persist_workspace archives restorable by hydrate_workspace

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az

[coderdailyone]

This pull request fixes UnixLocalSandboxSession.persist_workspace() so the archive it produces can actually be restored by hydrate_workspace().

Bug

persist_workspace() archives the workspace with tarfile.add() as-is, while hydrate_workspace() extracts with the strict policy (safe_extract_tarfile(..., allow_external_symlink_targets=False)) that refuses hardlink members, FIFOs / device nodes, and absolute symlink targets. Ordinary local workspaces contain all three, so the snapshot is taken successfully and then can never be restored. Reproduced on main with a real UnixLocalSandboxClient session (persist into one session, hydrate into a fresh one):

workspace content	hydrate result on main
a.txt + ln a.txt b.txt (what uv / pnpm do for every installed package)	WorkspaceArchiveWriteError — hardlink member not allowed, member ./b.txt
a FIFO left behind by a dev server (mkfifo pipe)	unsupported member type, member ./pipe
ln -s "$PWD/a.txt" abs_inside (absolute link to a file inside the workspace)	absolute symlink target not allowed: /tmp/sandbox-local-…/a.txt
python3 -m venv .venv	absolute symlink target not allowed: /usr/bin/python3

The last row is the intentional #3094 policy and is not changed here. The first three are not "external" in any sense, and the absolute-internal link is additionally wrong after restore even if it were accepted, because UnixLocal creates a fresh /tmp/sandbox-local-* root per session.

Fix

Add a filter step to the tarfile.add() call in persist_workspace() (_restorable_tar_member):

• hardlink members become regular file members (TarFile.add then reads the payload), so the restored workspace has two files with the same content;
• FIFOs and character/block device members are dropped (sockets already are, by tarfile);
• an absolute symlink target under the workspace root (checked against both the configured root and its resolved form, for hosts where /tmp is itself a symlink) is rewritten to a path relative to the link's own directory, e.g. /tmp/sandbox-local-x/a.txt from sub/abs_up becomes ../a.txt;
• everything else, including relative symlinks and absolute targets outside the workspace, is left untouched.

No public signatures change and hydrate_workspace() is not modified.

Evidence

• tests/sandbox/test_unix_local.py::TestUnixLocalPersistWorkspaceRestorable inspects the emitted members and round-trips the archive into a new root through hydrate_workspace(); both tests fail on main and pass with this change.
• tests/sandbox/test_unix_local.py, test_tar_utils.py, test_extract.py, ruff, mypy, and pyright on the changed files pass locally (Linux, Python 3.10).

🤖 Generated with Claude Code

https://claude.ai/code/session_01BN4v25msJgrjNgac97g1Az