Laufzeiten: die MCP-Bruecke ist auch ohne Starter in der Sandbox (#712)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-25 22:59:56 +02:00
parent a76983aa28
commit 7a8852fe6b
6 changed files with 26 additions and 4 deletions
@@ -223,7 +223,7 @@ public sealed class BwrapSandbox : ISandboxRunner
        // #712: what the launcher needs — the helper itself, the proxy's socket, the secrets.
        if (request.NeedsLauncher && helper is not null)
        {
-            foreach (var path in helper.ReadOnlyPaths)
+            foreach (var path in helper.ReadOnlyPaths.Except(request.ReadOnlyPaths.Select(Path.GetFullPath)))
                args.AddRange(["--ro-bind", path, path]);
            if (launch.EgressSocket is { } socket)
                args.AddRange(["--bind", socket, SandboxPaths.EgressSocket]);