fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade - #886

Open

Vasanthdev2004 wants to merge 53 commits into

mainfrom

fix/windows-restricted-sid-invariant

Commits on Sep 9, 2026

fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade
Vasanthdev2004
committed
6a4eff2
fix(sandbox): only warn about the DenyRead token trade on a Windows host
Vasanthdev2004
committed
93f9505
fix(sandbox): stop advertising a sandbox override that does not exist
Vasanthdev2004
committed
c4905d2
test(sandbox): pin the remedies the unelevated ACL failure offers
Vasanthdev2004
committed
3bfd898
test(sandbox): fail rather than skip when the DenyRead token loses the World SID
Vasanthdev2004
committed
915e1df
fix(sandbox): disclose the DenyRead write-jail trade on the execution path
Vasanthdev2004
committed
55621d2
fix(sandbox,tools): make the DenyRead disclosure reach a human, and project enforcement once
Vasanthdev2004
committed
5c64cef
fix(sandbox,plugins,hooks): disclose the write-jail trade where it actually happens
Vasanthdev2004
committed
f781481
fix(plugins,hooks): carry the disclosure through every post-launch outcome
Vasanthdev2004
committed
4e2231e
test(sandbox): pin the notice projection itself, not just its consumers
Vasanthdev2004
committed
0b646ad
fix(agent): carry one canonical representation of a tool result across the projection
Vasanthdev2004
committed
081aabd
fix(acp,cli): carry the enforcement notice to the consumers the projection left behind
Vasanthdev2004
committed
cd76c67
fix(execution): one launch-state decision, and disclose it on the MCP boundary
Vasanthdev2004
committed
76e5e35
fix(mcp,hooks): carry the enforcement fact to the durable consumers
Vasanthdev2004
committed
4f8aa57
fix(mcp): collect startup disclosures in the serial phase, and keep them past a failed start
Vasanthdev2004
committed
1ee7aa7
fix(cli): report MCP startup disclosures from headless exec
Vasanthdev2004
committed
85526b4
fix(execution): record launch state instead of inferring it from the outcome kind
Vasanthdev2004
committed
22c9194
fix(mcp): carry the launch disclosure through an initialize failure
Vasanthdev2004
committed
427df5f
fix(tools): derive command notices from applied execution state, not the plan
Vasanthdev2004
committed
f62ae77
fix(sandbox): gate the DenyRead diagnostic on the resolved plan
Vasanthdev2004
committed
e0e8db3
fix(tui): show the enforcement disclosure in cards and after resume
Vasanthdev2004
committed
f889b7e
fix(tools): measure the model output the enforcement notices are part of
Vasanthdev2004
committed
b60359e
test(sandbox): fail when the current-user SID prerequisite cannot be read
Vasanthdev2004
committed
e2ac98b
fix(mcp): keep the launch disclosure when registration times out
Vasanthdev2004
committed
6bf5a86
fix(tools): carry bash's real launch state into the shared outcome
Vasanthdev2004
committed
b44d56f
fix(mcp): synchronize the timeout with a start that is still completing
Vasanthdev2004
committed
fc06cc6
fix(tui): let the typed notice own the card's disclosure
Vasanthdev2004
committed
98fdb3e
fix(mcp): keep the launch fact alive past the registration bound
Vasanthdev2004
committed
60a1452
fix(mcp,tui): deliver the launch fact once, and persist one payload shape
Vasanthdev2004
committed
b619016
fix(mcp,cli): hand late launch disclosures to the output owner, not a retained callback
Vasanthdev2004
committed
591874f
fix(execution,sandbox): confirm the restricted child launched, not the Windows helper
Vasanthdev2004
committed
47d6ab7
fix(execution,sandbox,mcp,tools): one launch fact, applied by every launcher
Vasanthdev2004
committed
0ae48e4
fix(cli): give the late MCP disclosure and startup output one owner of stderr
Vasanthdev2004
committed
2176c98
fix(agent): deliver a successful beforeTool hook's output to the model
Vasanthdev2004
committed
b8d344d
fix(agent): drop the deprecated runtime.GOROOT fallback from the hook regression
Vasanthdev2004
committed
600bbc4
fix(agent,hooks): deliver only the beforeTool enforcement notice, on every exit
Vasanthdev2004
committed
4ccdab8
docs(hooks): state the property the notice accumulation actually holds
Vasanthdev2004
committed
b69ff67
fix(execution): observe the adapter's launch while the process is still running
Vasanthdev2004
committed
03ee13e
fix(mcp): gate the initialization-error disclosure on the confirmed child
Vasanthdev2004
committed
b16971f
docs(agent): record why the notice delivery path needs no rebudget
Vasanthdev2004
committed
886567f
fix(execution,mcp,sandbox): settle the launch decision before caching a no
Vasanthdev2004
committed
2f8dc76
fix(mcp): gate the success-path disclosure on the launch decision too
Vasanthdev2004
committed
67de11f
test(mcp): pin the StartupNotices launch gate at the carrier
Vasanthdev2004
committed
105e955
test(sandbox): fail the deny_read disclosure tests when the producer disappears
Vasanthdev2004
committed
b11a8a6
fix(agent): keep a beforeTool enforcement notice typed through the result
Vasanthdev2004
committed
3b7c741
fix(agent,hooks): give afterTool the same typed-notice contract as beforeTool
Vasanthdev2004
committed
6bce7d3
fix(sandbox): unwind the launch report when the suspended child cannot resume
Vasanthdev2004
committed
8535e4a
fix(sandbox,execution): let a failed resume revoke the launch it published
Vasanthdev2004
committed
33f62e7
test(sandbox): pin the retraction, and the fallback when it cannot be written
Vasanthdev2004
committed
f984082

Commits on Sep 12, 2026

Commits on Sep 13, 2026