toph/claudebox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(04): CR-01 CR-02 WR-01 fix credential path and use read-only bind mount

Browse source
This commit is contained in:
Christopher Mühl 2026-04-10 09:27:18 +00:00
parent 112f604856
commit adb9dd117d
1 changed files with 6 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
claudebox.sh
View file

@ -102,7 +102,9 @@ CWD=$(pwd)
mkdir -p "$HOME/.claudebox" mkdir -p "$HOME/.claudebox"
# Credential file mount (AUTH-01, AUTH-02) # Credential file mount (AUTH-01, AUTH-02)
CREDS_FILE="$HOME/.claude/.credentials.json" # Use ~/.claudebox (the host-side claudebox config dir), not ~/.claude
# ~/.claude -> ~/.claudebox symlink only exists inside the sandbox at runtime
CREDS_FILE="$HOME/.claudebox/.credentials.json"
if [[ -f "$CREDS_FILE" ]]; then if [[ -f "$CREDS_FILE" ]]; then
CREDS_MOUNT=true CREDS_MOUNT=true
else else
@ -264,7 +266,7 @@ print_audit() {
printf ' %-12s %s (read-write)\n' "CWD" "$CWD" >&2 printf ' %-12s %s (read-write)\n' "CWD" "$CWD" >&2
printf ' %-12s %s (read-write)\n' "~/.claude" "$HOME/.claudebox" >&2 printf ' %-12s %s (read-write)\n' "~/.claude" "$HOME/.claudebox" >&2
if [[ "$CREDS_MOUNT" == true ]]; then if [[ "$CREDS_MOUNT" == true ]]; then
printf ' %-12s %s (read-write)\n' "credentials" "$HOME/.claude/.credentials.json" >&2 printf ' %-12s %s (read-only)\n' "credentials" "$CREDS_FILE" >&2
fi fi
echo "" >&2 echo "" >&2
@ -328,7 +330,7 @@ if [[ "$DRY_RUN" == true ]]; then
echo " --bind $HOME/.claudebox $HOME/.claudebox \\" echo " --bind $HOME/.claudebox $HOME/.claudebox \\"
echo " --symlink $HOME/.claudebox $HOME/.claude \\" echo " --symlink $HOME/.claudebox $HOME/.claude \\"
if [[ "$CREDS_MOUNT" == true ]]; then if [[ "$CREDS_MOUNT" == true ]]; then
echo " --bind $CREDS_FILE $HOME/.claude/.credentials.json \\" echo " --ro-bind $CREDS_FILE $HOME/.claudebox/.credentials.json \\"
fi fi
printf ' --ro-bind %q %s/.gitconfig \\\n' "$GITCONFIG_TMP" "$HOME" printf ' --ro-bind %q %s/.gitconfig \\\n' "$GITCONFIG_TMP" "$HOME"
echo " --bind $CWD $CWD \\" echo " --bind $CWD $CWD \\"
@ -361,7 +363,7 @@ BWRAP_ARGS=(
--symlink "$HOME/.claudebox" "$HOME/.claude" --symlink "$HOME/.claudebox" "$HOME/.claude"
) )
if [[ "$CREDS_MOUNT" == true ]]; then if [[ "$CREDS_MOUNT" == true ]]; then
BWRAP_ARGS+=(--bind "$CREDS_FILE" "$HOME/.claude/.credentials.json") BWRAP_ARGS+=(--ro-bind "$CREDS_FILE" "$HOME/.claudebox/.credentials.json")
fi fi
BWRAP_ARGS+=( BWRAP_ARGS+=(
--ro-bind "$GITCONFIG_TMP" "$HOME/.gitconfig" --ro-bind "$GITCONFIG_TMP" "$HOME/.gitconfig"