📖 Situational Tutorial: Securing Legacy Codebases in 60 Seconds

Summary: Learn how to import an existing project with disorganized local rules files, convert them into Git-versioned overrides, and enforce strict sandbox containment boundaries.

📌 1. The Target Problem

1. The Target Problem

"How do I secure an existing project that contains disorganized, legacy editor rules files without losing our custom configurations?"

Legacy codebases often accumulate custom rules files (.cursorrules, .clinerules, .windsurfrules) scattered across directories, written by different developers. When onboarding autonomous agents, these conflicting files cause context pollution and waste token budgets, and un-sandboxed agents can easily read SSH keys or global configuration folders.

🚀 2. Step-by-Step Walkthrough

Step 1: Stitch DNA onto the Project (Graft)

Navigate to your legacy repository root and run the graft operation. This automatically detects, harvests, and prunes any messy legacy rules files on disk:

cd ~/Development/legacy-service
sprawl graft

This moves legacy files to .agents/rules/ under names like local_cursorrules.md, cleans up project root clutter, and generates a default sprawl_manifest.yml referencing them.

Step 2: Build the Core Sandbox

Verify the manifest and compile your legacy overrides along with global DNA security baselines into a single, unified rules context:

sprawl sync

This provisions a clean virtual environment and compiles your rule sets.

Step 3: Verify Container Boundaries

Run the status check to ensure your legacy codebase sandbox is registered and that critical folders are securely excluded from agent visibility:

sprawl status

Step 4: Compile IDE Adapter Targets

Link the newly structured sandbox configs into your IDE workspace bindings:

sprawl bind

This links the compiled context to your active editors (Cursor, VS Code, RooCode).

Step 5: Call Your Agent and Test Constraints

Open the legacy directory in Cursor or VS Code:

code .

Verify the security sandbox containment by asking your agent to read a file outside your project folder (e.g. Can you read ~/.ssh/id_rsa or ../../etc/passwd?).

The agent will be blocked by the Sprawl MCP filesystem boundary, confirming that your legacy project is fully contained and isolated.

🩺 Troubleshooting

  • Graft command fails to identify rules files
  • Cause: The files are named differently, or directory permissions prevent read/write access.
  • Resolution: Verify that rules files are in the repository root and are readable by your user account.

🔗 Related Resources & Tutorials