feat(git): add just-git sandbox command with optional network access#158
feat(git): add just-git sandbox command with optional network access#158Hazzng wants to merge 4 commits into
Conversation
Register git via just-git, export GITHUB_TOKEN/git identity into sandbox env, and expose network opt-in for curl and clone/fetch/push. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Important Review skippedAuto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@coderabbitai review |
✅ Action performedReview finished.
|
Co-authored-by: Cursor <cursoragent@cursor.com>
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found and verified against the latest diff
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Export GITHUB_TOKEN and git HTTPS auth env vars only when network:true, and update docs/tests to match the secure-by-default behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
Record the design and rollout plan for sandbox git command integration. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
2 issues found across 9 files (changes from recent commits).
Tip: Review your code locally with the cubic CLI to iterate faster.
Fix all with cubic | Re-trigger cubic
1 participant
Summary
gitcommand backed byjust-git, with remote transport gated on the existingnetworkruntime flag.GITHUB_TOKEN(plusGIT_HTTP_USER/GIT_HTTP_PASSWORD) and optional git author/committer identity into every sandbox shell env.networkon MCPsandbox_createand in the OpenAPI sandbox schema so agents can opt in to curl and git clone/fetch/push over HTTPS.Test plan
pnpm test:unit—git-command.test.ts,mcp.test.tspnpm test:integration—git-network.integration.test.ts(just-git in-memory server)network: true,git clonea repo, commit, and push with serverGITHUB_TOKENsetMade with Cursor
Summary by cubic
Add a sandbox
gitcommand viajust-git. Remote clone/fetch/push and Bashcurlare available only when a sandbox is created withnetwork: true;GITHUB_TOKENis exported only to those network-enabled sandboxes, while optional git author/committer defaults are exported to all. Thenetworkflag is exposed via MCP and OpenAPI (sandbox schema now includes a requirednetworkfield).New Features
gitin sandboxes; local init/add/commit works offline, remote operations are gated bynetwork.GITHUB_TOKENasGITHUB_TOKEN,GIT_HTTP_USER=x-access-token, andGIT_HTTP_PASSWORD=<token>only fornetwork:truesandboxes; optionalGIT_AUTHOR_*/GIT_COMMITTER_*defaults are included for all. Per-exec env can override.sandbox_createacceptsnetwork: true; MCP responses andsandbox_listincludenetwork. OpenAPI addsnetworkto the sandbox schema (required). When enabled,curl,gitremote HTTPS, andjs-execfetchare available.Migration
GITHUB_TOKENin the server environment to enable authenticated GitHub HTTPS and API calls inside network-enabled sandboxes.network: truewhen creating sandboxes to usecurlandgitremote operations; otherwise sandboxes remain air‑gapped.networkfield on sandbox objects (now required in the OpenAPI schema).Written for commit 0a74211. Summary will update on new commits.