Feature(cli): Add `--sync` to prevent AI agents from breaking the host files by unsuman · Pull Request #4429 · lima-vm/lima

unsuman · 2025-12-04T19:50:51Z

This PR adds a --sync flag to the limactl shell command that allows users to safely run AI commands inside VMs by syncing the host's working directory to the guest and optionally syncing changes back to the host after confirmation. Also added cleanup logic to remove the guest's synced workdir after user decision, ensuring no leftover files in the VM.

How to test

$ limactl start --mount-none
$ cd ~/some-project
$ limactl shell --sync <AI Agent Command>
OR
$ limactl shell --sync # simply shell into the instance and make changes
INFO[0000] Syncing host current directory(/Users/ansumansahoo/temp) to guest instance... 
INFO[0000] Successfully synced host current directory to guest(~/synced-workdir/temp) instance. 
ansumansahoo@lima-default:~/synced-workdir/temp$ vi source_dir/initials.txt 
ansumansahoo@lima-default:~/synced-workdir/temp$ exit
logout
? ⚠️ Accept the changes?  [Use arrows to move, type to filter]
  Yes
  No
> View the changed contents

When the program prompts the user to view the changes, a rsync is performed. This copies the guest synced directory to a temporary directory on the host. This allows diff to be used and the user to see a detailed list of changes.
Fixes #3711

AkihiroSuda · 2025-12-05T05:48:46Z

cmd/limactl/shell.go

 	shellCmd.Flags().Bool("reconnect", false, "Reconnect to the SSH session")
 	shellCmd.Flags().Bool("preserve-env", false, "Propagate environment variables to the shell")
 	shellCmd.Flags().Bool("start", false, "Start the instance if it is not already running")
+	shellCmd.Flags().Bool("sync-host-workdir", false, "Copy the host working directory to the guest to run AI commands inside VMs (prevents AI agents from breaking the host files)")


For consistency with --mount ., probably this should be like --sync .

The flag is not really specific to AI commands. Use case with AI should be mentioned in https://lima-vm.io/docs/examples/ai/ though.

AkihiroSuda · 2025-12-05T05:50:09Z

cmd/limactl/shell.go


+const (
+	rsyncMinimumSrcDirDepth = 4 // Depth of "/Users/USER" is 3.
+	guestSyncedWorkdir      = "~/synced-workdir"


Is there any reason that we cannot just use the same path as the host dir?
Is that for avoiding conflicts with mounts?

Is there any reason that we cannot just use the same path as the host dir?

Yes, issue with rsync because it only tries to create the base of the path and not the full path so using for example ansumansahoo@127.0.0.1:~/Users/ansumansahoo/Documents/GOLANG/lima as a destination path will result into an error rsync: [Receiver] mkdir "/home/ansumansahoo.linux/Users/ansumansahoo/Documents/GOLANG/lima" failed: No such file or directory (2)

Or do you mean to use only ansumansahoo@127.0.0.1:~/lima regarding this context?

it only tries to create the base of the path and not the full path

Why not run mkdir -p

AkihiroSuda · 2025-12-05T05:51:27Z

cmd/limactl/shell.go

+	}
+
+	for {
+		ans, err := uiutil.Select(message, options)


rsync can be slow and may eat up the host disk space, so this prompt should be shown before running rsync to the tmp dir

AkihiroSuda · 2025-12-05T05:52:35Z

cmd/limactl/shell.go

+			return
+		case 2: // View the changed contents
+			diffCmd := exec.CommandContext(ctx, "diff", "-ru", "--color=always", hostCurrentDir, filepath.Join(hostTmpDest, filepath.Base(hostCurrentDir)))
+			lessCmd := exec.CommandContext(ctx, "less", "-R")


Respect $PAGER

cmd/limactl/shell.go

AkihiroSuda · 2025-12-05T05:54:53Z

cmd/limactl/shell.go

+	if err != nil {
+		return fmt.Errorf("failed to get sync-host-workdir flag: %w", err)
+	} else if syncHostWorkdir && len(inst.Config.Mounts) > 0 {
+		return errors.New("cannot use `--sync-host-workdir` when the instance has host mounts configured, use `--mount-none` to disable mounts")


Suggested change

return errors.New("cannot use `--sync-host-workdir` when the instance has host mounts configured, use `--mount-none` to disable mounts")

return errors.New("cannot use `--sync-host-workdir` when the instance has host mounts configured, start the instance with `--mount-none` to disable mounts")

AkihiroSuda · 2025-12-05T05:56:05Z

cmd/limactl/shell.go

 		}
-	} else {
+	case syncHostWorkdir:
+		changeDirCmd = fmt.Sprintf("cd %s/%s", guestSyncedWorkdir, filepath.Base(hostCurrentDir))


Make sure to quote the path, as it may contain spaces and quote symbols

(Such paths should be tested in bats)

AkihiroSuda · 2025-12-05T05:58:08Z

cmd/limactl/shell.go

+	}
+	rsyncCmd := exec.CommandContext(ctx, "rsync", rsyncArgs...)
+	rsyncCmd.Stdin = os.Stdin
+	rsyncCmd.Stdout = os.Stdout


Use https://pkg.go.dev/github.com/spf13/cobra#Command.OutOrStdout

AkihiroSuda · 2025-12-05T05:58:19Z

cmd/limactl/shell.go

+		destination,
+	}
+	rsyncCmd := exec.CommandContext(ctx, "rsync", rsyncArgs...)
+	rsyncCmd.Stdin = os.Stdin


NVM, it was a mistake!

unsuman · 2025-12-05T14:19:59Z

Left with adding bats test and docs.

unsuman · 2025-12-09T07:34:27Z

How can I test existing bats test files?
I tried to run make bats first and it always results into 0 tests and 0 failures:

➜  lima2 git:(feat/rsync) ✗ ./hack/bats/lib/bats-core/bin/bats ./hack/bats/tests/list.bats

0 tests, 0 failures

➜  lima2 git:(feat/rsync) ✗ ./hack/bats/lib/bats-core/bin/bats --version
Bats 1.12.0

➜  lima2 git:(feat/rsync) ✗ lm -v
limactl version 2.0.1-122-g997e1287.m

[EDIT]: Ran a sample bats test and it works:

#!/usr/bin/env bats
@test "simple test" {
    run echo "hello"
    [ "$status" -eq 0 ]
    [ "$output" = "hello" ]
}

➜  lima2 git:(feat/rsync) ✗ ./hack/bats/lib/bats-core/bin/bats test-simple.bats                                                    
test-simple.bats
 ✓ simple test

1 test, 0 failures

unsuman · 2025-12-10T12:39:06Z

always results into 0 tests and 0 failures

This was due to the fact that my Bash version which comes out of the box on MacOS was 3.2 which was silently failing because Bash 3.2 does not support associative arrays(introduced in 4.0). Had to upgrade it using brew and now it works!

lima/hack/bats/helpers/load.bash

Line 81 in d8828f4

declare -A -g TEST_CONTAINER_IMAGES=(

AkihiroSuda · 2025-12-18T05:54:31Z

cmd/limactl/shell.go

+			if pager == "" {
+				pager = "less"
+			}
+			lessCmd := exec.CommandContext(ctx, pager, "-R")


Not every PAGER supports this flag

website/content/en/docs/examples/ai.md

AkihiroSuda · 2025-12-18T05:56:06Z

website/content/en/docs/examples/ai.md

+# Syncing Working Directory
+
+The `--sync` flag for `limactl shell` enables bidirectional synchronization of your host working directory with the guest VM. This is particularly useful when running AI agents (like Claude, Copilot, or Gemini) inside VMs to prevent them from accidentally modifying or breaking files on your host system.
+


Probably needs a table to compare mount vs sync

AkihiroSuda · 2026-01-09T07:26:56Z

cmd/limactl/shell.go

+			return fmt.Errorf("failed to create the synced workdir in guest instance: %w", err)
+		}
+
+		if runtime.GOOS == "darwin" {


MacOS’s version of rsync (the latest being 2.6.9) doesn’t handle shell escaping itself. However, Linux versions of rsync (specifically 3.x) efficiently manage this. A shell-escaped path in a Linux environment caused path not found issues.
See this

Better to add a comment

Shouldn’t it check the version, not OS?

AkihiroSuda · 2026-01-09T07:27:37Z

website/content/en/docs/examples/ai.md

+ |----------------|-------------|
+
+The `--sync` flag for `limactl shell` enables bidirectional synchronization of your host working directory with the guest VM. This is particularly useful when running AI agents (like Claude, Copilot, or Gemini) inside VMs to prevent them from accidentally modifying or breaking files on your host system.
+


The comparison table should be shown before the example commands

AkihiroSuda · 2026-01-09T07:27:49Z

website/content/en/docs/examples/ai.md

+1. Create an isolated instance for AI agents which must be started without host mounts for `--sync` to work:
+
+```bash
+limactl start --name=ai-sandbox --mount-none template://default


--name should not be needed

AkihiroSuda · 2026-01-19T06:19:01Z

cmd/limactl/shell.go

 	shellCmd.Flags().Bool("preserve-env", false, "Propagate environment variables to the shell")
 	shellCmd.Flags().Bool("start", false, "Start the instance if it is not already running")
+	shellCmd.Flags().String("sync", "", "Copy the host working directory to the guest and vice-versa upon exit")
+	shellCmd.Flags().Lookup("sync").NoOptDefVal = "."


Not sure if we want NoOptDefVal.
Probably this one should be omitted from this PR, and should be revisited in a separate issue.

AkihiroSuda · 2026-01-19T06:19:14Z

cmd/limactl/shell.go

 	shellCmd.Flags().Bool("reconnect", false, "Reconnect to the SSH session")
 	shellCmd.Flags().Bool("preserve-env", false, "Propagate environment variables to the shell")
 	shellCmd.Flags().Bool("start", false, "Start the instance if it is not already running")
+	shellCmd.Flags().String("sync", "", "Copy the host working directory to the guest and vice-versa upon exit")


Suggested change

shellCmd.Flags().String("sync", "", "Copy the host working directory to the guest and vice-versa upon exit")

shellCmd.Flags().String("sync", "", "Copy a host directory to the guest and vice-versa upon exit")

AkihiroSuda · 2026-01-19T06:19:43Z

website/content/en/docs/examples/ai.md

-See also <https://github.com/anomalyco/opencode>.
-{{% /tab %}}
+```bash
+limactl shell --sync default claude "Add error handling to all functions"


Suggested change

limactl shell --sync default claude "Add error handling to all functions"

limactl shell --sync . default claude "Add error handling to all functions"

AkihiroSuda · 2026-01-19T06:19:48Z

website/content/en/docs/examples/ai.md

-{{< /tabpane >}}
+Or simply shell into the instance and make changes:
+```bash
+limactl shell --sync default


same as above

AkihiroSuda · 2026-01-20T00:25:58Z

cmd/limactl/shell.go

 	//              := "cd hostCurrentDir || cd hostHomeDir"   if workDir == ""
 	var changeDirCmd string
+	var hostCurrentDir string
+	if syncDirVal != "" && syncDirVal != "." {


Why need to check syncDirVal != "." here?

Oh, I didn't know that filepath.Abs() translates . to cwd.

hack/bats/tests/shell-sync.bats

AkihiroSuda

Thanks

jandubois

Mostly looking good, but the hard-coded home directory name should be fixed.

jandubois · 2026-01-21T00:49:27Z

cmd/limactl/shell.go

 		}
-	} else {
+	case syncHostWorkdir:
+		destRsyncDir = fmt.Sprintf("/home/%s.linux%s", *inst.Config.User.Name, hostCurrentDir)


The home directory is configurable; don't recompute the default value:

Suggested change

destRsyncDir = fmt.Sprintf("/home/%s.linux%s", *inst.Config.User.Name, hostCurrentDir)

destRsyncDir = *inst.Config.User.Home + hostCurrentDir

There is another instance of this further down in the file.

jandubois · 2026-01-21T00:53:08Z

cmd/limactl/shell.go

+	remoteSource := fmt.Sprintf("%s:%s", *inst.Config.User.Name+"@"+inst.SSHAddress, destRsyncDir)
+	clean := filepath.Clean(hostCurrentDir)
+	parts := strings.Split(clean, string(filepath.Separator))
+	dirForCleanup := shellescape.Quote(fmt.Sprintf("/home/%s.linux/", *inst.Config.User.Name) + parts[1])


Use User.Home instead. Also check that strings.Split() has returned at least 2 elements.

jandubois · 2026-01-21T00:55:35Z

cmd/limactl/shell.go

+		if err := rsyncDirectory(ctx, cmd, sshCmd, remoteSource, filepath.Dir(hostCurrentDir)); err != nil {
+			logrus.WithError(err).Warn("Failed to sync back the changes to host")
+			return
+		}


Should this function return an error? Why are these failures just logging a warning, and then continue as if everything is ok?

jandubois · 2026-01-21T00:58:30Z

cmd/limactl/shell.go

+		ans, err := uiutil.Select(message, options)
+		if err != nil {
+			if errors.Is(err, uiutil.InterruptErr) {
+				logrus.Fatal("Interrupted by user")


Fatal exits the process right away and should be reserved for unrecoverable errors. This feels more like a shortcut for regular control flow because we can't return an error.

jandubois · 2026-01-21T01:00:09Z

cmd/limactl/shell.go

+		source,
+		destination,
+	}
+	rsyncCmd := exec.CommandContext(ctx, "rsync", rsyncArgs...)


Please create an issue for it if you don't include it in the PR.

AkihiroSuda · 2026-01-29T03:41:54Z

@jandubois Can we merge this and release v2.1 alpha ?
FOSDEM is on this weekend

jandubois · 2026-01-29T07:12:55Z

Can we merge this and release v2.1 alpha ? FOSDEM is on this weekend

Sorry, I didn't realize this. I thought 2.1 was planned for KubeCon.

I can't review until tomorrow, but I'm fine with you merging it if you and @unsuman both think it is fine. It will just be an alpha, after all.

AkihiroSuda · 2026-01-29T08:56:32Z

cmd/limactl/shell.go

+			if pager == "" {
+				pager = "less"
+			}
+			lessCmd := exec.CommandContext(ctx, pager)


This doesn't work when PAGER contains whitespaces

AkihiroSuda · 2026-01-29T09:29:28Z

I thought 2.1 was planned for KubeCon.

Yes, the plan is unchanged.
For FOSDEM I just want an alpha.

AkihiroSuda · 2026-01-30T01:27:10Z

CI failing

jandubois · 2026-01-30T04:22:30Z

CI failing

Because the PR needs to be rebased on latest master. CI wants to run colima.bats which doesn't exist in this PR.

jandubois · 2026-01-30T04:54:24Z

cmd/limactl/shell.go

+	var sshExecForRsync *exec.Cmd
+	if syncHostWorkdir {
+		logrus.Infof("Syncing host current directory(%s) to guest instance...", hostCurrentDir)
+		sshExecForRsync = exec.CommandContext(ctx, sshExe.Exe, sshArgs...)


I think this is missing the port and host arguments. It looks like it works if it connects via the ControlMaster socket, but if that is broken, it will not create its own connection:

❯ rm ~/.lima/default/ssh.sock ❯ limactl shell --sync . --yes default pwd INFO[0000] Syncing host current directory(/Users/jan/suse/lima/hack/bats) to guest instance... FATA[0000] failed to create the synced workdir in guest instance: exit status 255

I think the BATS test need to include variants that delete the ssh.sock to properly test the explicit SSH commands.

jandubois · 2026-01-30T04:58:47Z

cmd/limactl/shell.go

+}
+
+func executeSSHForRsync(ctx context.Context, sshCmd *exec.Cmd, command string) error {
+	sshRmCmd := exec.CommandContext(ctx, sshCmd.Path, append(sshCmd.Args, command)...)


Suggested change

sshRmCmd := exec.CommandContext(ctx, sshCmd.Path, append(sshCmd.Args, command)...)

// Skip Args[0] (program name) to avoid duplication

sshRmCmd := exec.CommandContext(ctx, sshCmd.Path, append(sshCmd.Args[1:], command)...)

…g the host files Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>

jandubois

Thanks, LGTM

unsuman force-pushed the feat/rsync branch from 640a39b to cb663bd Compare December 4, 2025 19:58

AkihiroSuda reviewed Dec 5, 2025

View reviewed changes

cmd/limactl/shell.go Show resolved Hide resolved

AkihiroSuda reviewed Dec 5, 2025

View reviewed changes

unsuman force-pushed the feat/rsync branch from cb663bd to 997e128 Compare December 5, 2025 14:19

unsuman force-pushed the feat/rsync branch from 997e128 to e6577f3 Compare December 9, 2025 07:36

unsuman changed the title ~~Feature(cli): Add sync-host-workdir to prevent AI agents from breaking the host files~~ Feature(cli): Add --sync to prevent AI agents from breaking the host files Dec 9, 2025

AkihiroSuda added this to the v2.1.0 (?) milestone Dec 11, 2025

unsuman force-pushed the feat/rsync branch from e6577f3 to 87bc000 Compare December 18, 2025 03:53

AkihiroSuda reviewed Dec 18, 2025

View reviewed changes

website/content/en/docs/examples/ai.md Show resolved Hide resolved

AkihiroSuda reviewed Dec 18, 2025

View reviewed changes

unsuman force-pushed the feat/rsync branch 5 times, most recently from 96e3dd1 to d501990 Compare January 4, 2026 20:41

unsuman requested a review from AkihiroSuda January 4, 2026 21:03

AkihiroSuda reviewed Jan 9, 2026

View reviewed changes

AkihiroSuda reviewed Jan 19, 2026

View reviewed changes

AkihiroSuda added the impact/changelog label Jan 19, 2026

unsuman force-pushed the feat/rsync branch from 9849c62 to 4cb1cc4 Compare January 19, 2026 08:33

AkihiroSuda reviewed Jan 20, 2026

View reviewed changes

hack/bats/tests/shell-sync.bats Show resolved Hide resolved

AkihiroSuda previously approved these changes Jan 20, 2026

View reviewed changes

AkihiroSuda requested a review from a team January 20, 2026 00:28

unsuman dismissed AkihiroSuda’s stale review via 7572f95 January 20, 2026 13:00

unsuman force-pushed the feat/rsync branch from 4cb1cc4 to 7572f95 Compare January 20, 2026 13:00

jandubois requested changes Jan 21, 2026

View reviewed changes

unsuman force-pushed the feat/rsync branch from 7572f95 to 5585e3c Compare January 21, 2026 16:08

AkihiroSuda requested a review from jandubois January 27, 2026 06:40

AkihiroSuda mentioned this pull request Jan 27, 2026

v2.1 planning #4548

Open

AkihiroSuda reviewed Jan 29, 2026

View reviewed changes

unsuman force-pushed the feat/rsync branch from 5585e3c to b079f95 Compare January 29, 2026 09:20

jandubois requested changes Jan 30, 2026

View reviewed changes

jandubois reviewed Jan 30, 2026

View reviewed changes

feature(cli): add sync-host-workdir to prevent AI agents from breakin…

02c7dd5

…g the host files Signed-off-by: Ansuman Sahoo <anshumansahoo500@gmail.com>

unsuman force-pushed the feat/rsync branch from b079f95 to 02c7dd5 Compare January 30, 2026 12:46

unsuman requested a review from jandubois January 30, 2026 13:07

jandubois approved these changes Jan 30, 2026

View reviewed changes

jandubois merged commit 4508659 into lima-vm:master Jan 30, 2026
37 checks passed

	return errors.New("cannot use `--sync-host-workdir` when the instance has host mounts configured, use `--mount-none` to disable mounts")
	return errors.New("cannot use `--sync-host-workdir` when the instance has host mounts configured, start the instance with `--mount-none` to disable mounts")

		# Syncing Working Directory

		The `--sync` flag for `limactl shell` enables bidirectional synchronization of your host working directory with the guest VM. This is particularly useful when running AI agents (like Claude, Copilot, or Gemini) inside VMs to prevent them from accidentally modifying or breaking files on your host system.

		\|----------------\|-------------\|

		The `--sync` flag for `limactl shell` enables bidirectional synchronization of your host working directory with the guest VM. This is particularly useful when running AI agents (like Claude, Copilot, or Gemini) inside VMs to prevent them from accidentally modifying or breaking files on your host system.

	shellCmd.Flags().String("sync", "", "Copy the host working directory to the guest and vice-versa upon exit")
	shellCmd.Flags().String("sync", "", "Copy a host directory to the guest and vice-versa upon exit")

	limactl shell --sync default claude "Add error handling to all functions"
	limactl shell --sync . default claude "Add error handling to all functions"

	destRsyncDir = fmt.Sprintf("/home/%s.linux%s", *inst.Config.User.Name, hostCurrentDir)
	destRsyncDir = *inst.Config.User.Home + hostCurrentDir

	sshRmCmd := exec.CommandContext(ctx, sshCmd.Path, append(sshCmd.Args, command)...)
	// Skip Args[0] (program name) to avoid duplication
	sshRmCmd := exec.CommandContext(ctx, sshCmd.Path, append(sshCmd.Args[1:], command)...)

Conversation

unsuman commented Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to test

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

unsuman commented Dec 5, 2025

Uh oh!

unsuman commented Dec 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

unsuman commented Dec 10, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

AkihiroSuda left a comment

Choose a reason for hiding this comment

Uh oh!

jandubois left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

unsuman commented Dec 4, 2025 •

edited

Loading

unsuman commented Dec 9, 2025 •

edited

Loading