AX-1941: add *.jfrog.io to workspace sandbox allowlist (with code review fixes) - #80
Open
MatanEden1 wants to merge 5 commits into
Open
AX-1941: add *.jfrog.io to workspace sandbox allowlist (with code review fixes)#80MatanEden1 wants to merge 5 commits into
MatanEden1 wants to merge 5 commits into
Conversation
Co-authored-by: Cursor <cursoragent@cursor.com>
- Revert the 403-as-blocked change: a server-side 403 means the CONNECT tunnel succeeded and the host IS reachable. Only HTTP 000 means blocked. - Use arithmetic (( blocked )) instead of string comparison. - Print HTTPS_PROXY in env diagnostics (all probed URLs are HTTPS). Co-authored-by: Cursor <cursoragent@cursor.com>
Do not append 000 when curl exits 56; that concatenated to 000000 and treated a CONNECT drop as reachable. Co-authored-by: Cursor <cursoragent@cursor.com>
- sandbox.json: add explicit "default": "deny" for clarity - test script: add DENY_HOSTS probe for negative coverage - test script: remove 2>/dev/null so curl errors are visible - test script: add --connect-timeout 3 for fast failure on blocked hosts Co-authored-by: Cursor <cursoragent@cursor.com>
- sandbox.json: remove "default":"deny" — workspace allow entries are unioned with Cursor's defaults; an explicit deny directive risked replacing them - test script: replace example.com deny-hosts with RFC 5737 (203.0.113.1) and RFC 2606 (.invalid TLD) addresses that are structurally guaranteed unreachable, preventing future false failures if Cursor's defaults ever include example.com - test script: add proxy env-vars guard — exit 2 when CURSOR_SANDBOX=seatbelt but neither HTTP_PROXY nor HTTPS_PROXY is set (curl would bypass the proxy, making every host look reachable) - test script: add want-argument validation in probe() to catch typos early - test script: clarify the curl "000" and ((fail++)) || true comments Co-authored-by: Cursor <cursoragent@cursor.com>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a workspace
.cursor/sandbox.jsonto unblock*.jfrog.ioinside Cursor's Agents Window (CURSOR_SANDBOX=seatbelt) sandbox, and a probe script to verify the fix.This is a revised version of #79 with all code review findings addressed.
Changes
.cursor/sandbox.json— workspace network allowlist adding*.jfrog.ioscripts/test-sandbox-network.sh— probe script to verify the fix from inside the Agents WindowCode review fixes (vs #79)
sandbox.json: Removed"default": "deny"— workspaceallowentries are unioned with Cursor's defaults; the explicit deny directive risked replacing them entirely rather than extending them.test-sandbox-network.sh: Replacedexample.comdeny-hosts with203.0.113.1(RFC 5737 TEST-NET-3) anddns-test.blocked.invalid(RFC 2606.invalidTLD) — structurally guaranteed unreachable, immune to future Cursor allow-list changes.test-sandbox-network.sh: Added proxy env-vars guard — exits 2 whenCURSOR_SANDBOX=seatbeltbut neitherHTTPS_PROXYnorHTTP_PROXYis set (curl would bypass the sandbox proxy and make every host look reachable).test-sandbox-network.sh: Addedwant-argument validation inprobe()to catch typos early.test-sandbox-network.sh: Corrected the curl"000"comment and clarified why((fail++)) || trueneeds|| trueunderset -e.Test plan
Run
scripts/test-sandbox-network.shfrom inside the Agents Window after applying this change. Exit 0 = all hosts behaved as expected, exit 1 = one or more failures, exit 2 = not running inside the sandbox.Closes #78
Made with Cursor