@cairnkeep/cli 2.2.0 → 2.2.1

package/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable user-facing changes are documented here. This project follows
 [Semantic Versioning](https://semver.org/).
 
+## [2.2.1] - 2026-07-20
+
+### Fixed
+
+- Make default sandbox-volume names path-specific so same-named repositories
+  cannot share a workspace accidentally.
+- Refuse to merge repository content into a non-empty unmarked workspace
+  volume.
+- Document that sandbox copies include untracked files and must be treated as
+  sensitive persistent data.
+
 ## [2.2.0] - 2026-07-20
 
 ### Added

package/containers/workspace-entrypoint.sh

@@ -11,6 +11,10 @@ case "$mode" in
       exit 66
     fi
     if [ ! -e /workspace/.cairnkeep-sandbox-ready ]; then
+      if find /workspace -mindepth 1 -maxdepth 1 -print -quit | grep -q .; then
+        echo "cairnkeep: refusing to initialize a non-empty unmarked workspace volume" >&2
+        exit 65
+      fi
       cp -a /source/. /workspace/
       : > /workspace/.cairnkeep-sandbox-ready
     fi

package/docs/containers.md

@@ -154,8 +154,14 @@ cairn-container workspace --repo /path/to/repository
 ```
 
 Rerunning the command with the same workspace volume resumes the copy. Use
-`--workspace-volume` when repositories have the same basename or when an
-explicit lifecycle is preferable.
+`--workspace-volume` when an explicit lifecycle is preferable. Default volume
+names include both the repository basename and a checksum of its absolute path,
+so same-named repositories do not share a sandbox accidentally.
+
+The initial copy includes tracked and untracked files. Treat the workspace
+volume as sensitive local data and remove it when it is no longer needed.
+Cairnkeep refuses to initialize a non-empty volume that lacks its sandbox
+marker rather than merging unrelated content.
 
 `shared` mode is opt-in and bind-mounts the checkout read/write:
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cairnkeep/cli",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "A durable, harness-agnostic memory + context layer for coding agents (Claude Code, OpenCode).",
   "license": "Apache-2.0",
   "type": "module",

package/scripts/cairn-container

@@ -171,7 +171,8 @@ run_workspace() {
   repo=$(absolute_dir "$repo")
   case "$mode" in sandbox | shared) ;; *) fail "--mode must be sandbox or shared" ;; esac
   if [ -z "$workspace_volume" ]; then
-    workspace_volume="cairnkeep-workspace-$(safe_name "$(basename "$repo")")"
+    repo_id=$(printf '%s' "$repo" | cksum | awk '{print $1}')
+    workspace_volume="cairnkeep-workspace-$(safe_name "$(basename "$repo")")-$repo_id"
   fi
 
   require_engine

package/scripts/test-container-runner.sh

@@ -80,4 +80,8 @@ has_arg CAIRN_WORKSPACE_MODE=shared
 lacks_arg "$repo:/source:ro,Z"
 has_arg bash
 
+repo_id=$(printf '%s' "$repo" | cksum | awk '{print $1}')
+run_launcher workspace --repo "$repo" --image example/workspace:1
+has_arg "cairnkeep-workspace-repository-$repo_id:/workspace:Z,U"
+
 echo "PASS: container launcher security and workspace contracts"

package/scripts/test-container.sh

@@ -21,12 +21,13 @@ server_image="localhost/cairnkeep-test-server:$suffix"
 workspace_image="localhost/cairnkeep-test-workspace:$suffix"
 volume="cairnkeep-test-data-$suffix"
 sandbox_volume="cairnkeep-test-workspace-$suffix"
+conflict_volume="cairnkeep-test-conflict-$suffix"
 name="cairnkeep-test-$suffix"
 tmp=$(mktemp -d)
 
 cleanup() {
   "$ENGINE" rm -f "$name" >/dev/null 2>&1 || true
-  "$ENGINE" volume rm -f "$volume" "$sandbox_volume" >/dev/null 2>&1 || true
+  "$ENGINE" volume rm -f "$volume" "$sandbox_volume" "$conflict_volume" >/dev/null 2>&1 || true
   "$ENGINE" image rm -f "$server_image" "$workspace_image" >/dev/null 2>&1 || true
   rm -rf "$tmp"
 }
@@ -180,4 +181,34 @@ else
     "$workspace_image" sh -c 'test "$(cat sandbox.txt)" = sandbox'
 fi
 
+# A pre-populated, unmarked volume must not be merged with repository content.
+"$ENGINE" volume create "$conflict_volume" >/dev/null
+if [[ "$ENGINE" == podman ]]; then
+  "$ENGINE" run --rm --userns=keep-id:uid=10001,gid=10001 \
+    --volume "$conflict_volume:/workspace:Z,U" \
+    --env CAIRN_WORKSPACE_MODE=shared \
+    "$workspace_image" sh -c 'printf unrelated > unrelated.txt'
+else
+  "$ENGINE" run --rm --user root --entrypoint sh \
+    --volume "$conflict_volume:/workspace" "$workspace_image" \
+    -c 'printf unrelated > /workspace/unrelated.txt; chown -R 10001:10001 /workspace'
+fi
+if [[ "$ENGINE" == podman ]]; then
+  conflict_mounts=(
+    --userns=keep-id:uid=10001,gid=10001
+    --volume "$tmp/repo:/source:ro,Z"
+    --volume "$conflict_volume:/workspace:Z,U"
+  )
+else
+  conflict_mounts=(
+    --volume "$tmp/repo:/source:ro"
+    --volume "$conflict_volume:/workspace"
+  )
+fi
+if "$ENGINE" run --rm "${conflict_mounts[@]}" \
+  --env CAIRN_WORKSPACE_MODE=sandbox "$workspace_image" true >/dev/null 2>&1; then
+  echo "FAIL: sandbox merged into a non-empty unmarked volume" >&2
+  exit 1
+fi
+
 echo "PASS: container stdio, guarded HTTP, persistence, shared, and sandbox modes"