fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade - #886

Open

Vasanthdev2004 wants to merge 60 commits into

mainfrom

fix/windows-restricted-sid-invariant

Commits on Sep 9, 2026

fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade
Vasanthdev2004
committed
6a4eff2
fix(sandbox): only warn about the DenyRead token trade on a Windows host
Vasanthdev2004
committed
93f9505
fix(sandbox): stop advertising a sandbox override that does not exist
Vasanthdev2004
committed
c4905d2
test(sandbox): pin the remedies the unelevated ACL failure offers
Vasanthdev2004
committed
3bfd898
test(sandbox): fail rather than skip when the DenyRead token loses the World SID
Vasanthdev2004
committed
915e1df
fix(sandbox): disclose the DenyRead write-jail trade on the execution path
Vasanthdev2004
committed
55621d2
fix(sandbox,tools): make the DenyRead disclosure reach a human, and project enforcement once
Vasanthdev2004
committed
5c64cef
fix(sandbox,plugins,hooks): disclose the write-jail trade where it actually happens
Vasanthdev2004
committed
f781481
fix(plugins,hooks): carry the disclosure through every post-launch outcome
Vasanthdev2004
committed
4e2231e
test(sandbox): pin the notice projection itself, not just its consumers
Vasanthdev2004
committed
0b646ad
fix(agent): carry one canonical representation of a tool result across the projection
Vasanthdev2004
committed
081aabd
fix(acp,cli): carry the enforcement notice to the consumers the projection left behind
Vasanthdev2004
committed
cd76c67
fix(execution): one launch-state decision, and disclose it on the MCP boundary
Vasanthdev2004
committed
76e5e35
fix(mcp,hooks): carry the enforcement fact to the durable consumers
Vasanthdev2004
committed
4f8aa57
fix(mcp): collect startup disclosures in the serial phase, and keep them past a failed start
Vasanthdev2004
committed
1ee7aa7
fix(cli): report MCP startup disclosures from headless exec
Vasanthdev2004
committed
85526b4
fix(execution): record launch state instead of inferring it from the outcome kind
Vasanthdev2004
committed
22c9194
fix(mcp): carry the launch disclosure through an initialize failure
Vasanthdev2004
committed
427df5f
fix(tools): derive command notices from applied execution state, not the plan
Vasanthdev2004
committed
f62ae77
fix(sandbox): gate the DenyRead diagnostic on the resolved plan
Vasanthdev2004
committed
e0e8db3
fix(tui): show the enforcement disclosure in cards and after resume
Vasanthdev2004
committed
f889b7e
fix(tools): measure the model output the enforcement notices are part of
Vasanthdev2004
committed
b60359e
test(sandbox): fail when the current-user SID prerequisite cannot be read
Vasanthdev2004
committed
e2ac98b
fix(mcp): keep the launch disclosure when registration times out
Vasanthdev2004
committed
6bf5a86
fix(tools): carry bash's real launch state into the shared outcome
Vasanthdev2004
committed
b44d56f
fix(mcp): synchronize the timeout with a start that is still completing
Vasanthdev2004
committed
fc06cc6
fix(tui): let the typed notice own the card's disclosure
Vasanthdev2004
committed
98fdb3e
fix(mcp): keep the launch fact alive past the registration bound
Vasanthdev2004
committed
60a1452
fix(mcp,tui): deliver the launch fact once, and persist one payload shape
Vasanthdev2004
committed
b619016
fix(mcp,cli): hand late launch disclosures to the output owner, not a retained callback
Vasanthdev2004
committed
591874f
fix(execution,sandbox): confirm the restricted child launched, not the Windows helper
Vasanthdev2004
committed
47d6ab7
fix(execution,sandbox,mcp,tools): one launch fact, applied by every launcher
Vasanthdev2004
committed
0ae48e4
fix(cli): give the late MCP disclosure and startup output one owner of stderr
Vasanthdev2004
committed
2176c98
fix(agent): deliver a successful beforeTool hook's output to the model
Vasanthdev2004
committed
b8d344d
fix(agent): drop the deprecated runtime.GOROOT fallback from the hook regression
Vasanthdev2004
committed
600bbc4
fix(agent,hooks): deliver only the beforeTool enforcement notice, on every exit
Vasanthdev2004
committed
4ccdab8
docs(hooks): state the property the notice accumulation actually holds
Vasanthdev2004
committed
b69ff67
fix(execution): observe the adapter's launch while the process is still running
Vasanthdev2004
committed
03ee13e
fix(mcp): gate the initialization-error disclosure on the confirmed child
Vasanthdev2004
committed
b16971f
docs(agent): record why the notice delivery path needs no rebudget
Vasanthdev2004
committed
886567f
fix(execution,mcp,sandbox): settle the launch decision before caching a no
Vasanthdev2004
committed
2f8dc76
fix(mcp): gate the success-path disclosure on the launch decision too
Vasanthdev2004
committed
67de11f
test(mcp): pin the StartupNotices launch gate at the carrier
Vasanthdev2004
committed
105e955
test(sandbox): fail the deny_read disclosure tests when the producer disappears
Vasanthdev2004
committed
b11a8a6
fix(agent): keep a beforeTool enforcement notice typed through the result
Vasanthdev2004
committed
3b7c741
fix(agent,hooks): give afterTool the same typed-notice contract as beforeTool
Vasanthdev2004
committed
6bce7d3
fix(sandbox): unwind the launch report when the suspended child cannot resume
Vasanthdev2004
committed
8535e4a
fix(sandbox,execution): let a failed resume revoke the launch it published
Vasanthdev2004
committed
33f62e7
test(sandbox): pin the retraction, and the fallback when it cannot be written
Vasanthdev2004
committed
f984082

Commits on Sep 12, 2026

Commits on Sep 13, 2026

Commits on Sep 15, 2026

Merge origin/main into fix/windows-restricted-sid-invariant
Vasanthdev2004
committed
9d8059c

Commits on Sep 19, 2026

Commits on Sep 21, 2026

fix(acp): persist tool results through the shared session contract
Vasanthdev2004
committed
daf9b8c

Commits on Sep 24, 2026