Sam Lamrabte e8c8ef1142 Harden permission enforcement against sandbox bypasses ...

Close two ways the permission system could be bypassed:

- Workspace path traversal: normalize `.`/`..` lexically before the
  boundary prefix comparison so paths like `/workspace/../../etc` can no
  longer escape the sandbox. Fixed in both the runtime enforcer and the
  duplicate check in the tools PowerShell path classifier.
- read-only mode no longer trusts the leading token alone: reject shell
  metacharacters (chaining/substitution/redirect/pipe/subshell), drop
  interpreters and build drivers (python/node/ruby/cargo/rustc) from the
  allow-list, gate `git` to non-mutating subcommands, and reject `find`
  actions that execute or delete.

Adds regression tests for both holes. The pre-existing, unrelated
worker_boot git-metadata test failure is not affected by this change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-31 13:26:39 +02:00

..

src

Harden permission enforcement against sandbox bypasses

2026-05-31 13:26:39 +02:00

tests

omx(team): auto-checkpoint worker-3 [4]

2026-05-14 18:26:55 +09:00

Cargo.toml

fix(#698): dedup config deprecation warnings per process; add tempfile dev-dep to runtime crate (fixes pre-existing test compile error)

2026-05-25 14:11:37 +09:00