feat: migrate Linux sandbox to bwrap, harden with adversarial escape testing#7

Merged

machado144 merged 8 commits intomainfrom

feat/bwrap-sandbox

Mar 30, 2026

Commits on Mar 24, 2026

feat: migrate Linux sandbox to bwrap, add doctor command

machado144
and
claude
committed

Commits on Mar 30, 2026

feat: add integration sandbox tests, CI vuln scanning, upgrade Go 1.25

machado144
and
claude
committed
test: add adversarial sandbox escape integration tests

machado144
and
claude
committed
test: rewrite sandbox escape tests to find real bypasses

machado144
and
claude
committed
fix: harden bwrap sandbox — close 3 escape bypasses

machado144
and
claude
committed
fix: make home writable, protect sensitive dotfiles with ro-bind

machado144
and
claude
committed
test: fix weak escape tests, skip known limitations honestly

machado144
and
claude
committed
fix(ci): skip sandbox tests without bwrap, fix golangci-lint Go version

machado144
and
claude
committed