fix(security): contain sandbox paths and output - #931

Draft

seonghobae wants to merge 15 commits into

mainfrom

fix/sandboxed-verify-symlink-boundary-20260811

Commits on Aug 11, 2026

test(security): expose sandbox symlink escape
seonghobae
committed
faca1f1
fix(security): reject sandbox-escaping symlinks
seonghobae
committed
856d92f
test(security): cover absolute and relative symlink escapes
seonghobae
committed
ea6ac85
docs(security): record verifier symlink boundary
seonghobae
committed
c0aefd3
test(security): close verifier branch coverage
seonghobae
committed
ee903b8
test(security): expose ignored-link false positive
seonghobae
committed
6f59730
fix(security): validate exact sandbox copy
seonghobae
committed
ea2672a
docs(security): scope validation to copied tree
seonghobae
committed
46b2237
test(security): expose unbounded sandbox output
seonghobae
committed
b4547a5
fix(security): bound sandbox evidence streams
seonghobae
committed
52e1281
fix(sandbox): preserve capture ownership evidence
seonghobae
committed
7b29a20
fix(sandbox): classify path and cleanup failures
seonghobae
committed
ce370cf
fix(sandbox): validate missing-log budgets
seonghobae
committed
92990d2
test(sandbox): isolate platform capability probes
seonghobae
committed
4cbf3f6
test(sandbox): synchronize service readiness
seonghobae
committed
dd2132b