2 commits

Author	SHA1	Message	Date
xyf2020	e5bbb85e54	fix(python): sandbox Python execution and disable benchmark service exposure (#708) ... * fix: sandbox Python execution and disable benchmark service exposure * fix: preserve optional sandbox policy for AutoBash * fix: sandbox AutoBash with a read-only workspace by default * fix: preserve sandboxed Python timeout diagnostics * Simplify Python timeout handling and sandbox workspace defaults * fix: require patched core for home and allow sandboxed Apple Git * fix: preserve Python execution workspace directory * fix: cap Python execution timeouts and allow Xcode Git runtime * Fix macOS sandbox Git resolution and add Xcode CI coverage * Make Seatbelt runtime grant test independent of host Xcode symlinks	2026-11-04 14:31:59 +08:00
xyf2020	2767836b21	feat(sandbox): Add Home AutoBash plugin and path-scoped execution sandboxes (#603) ... * Add sandboxed Python execution and home AutoBash plugin * Harden read-only shell commands and filesystem sandboxes * Group file sandbox backends in one package * Fix macOS file sandbox isolation and runtime access * Refine file sandbox limits and executor checks * Harden AutoBash policy and macOS sandbox supervision * fix(home): require ReMe release with file sandbox * refactor(home): simplify sandbox calls and redundant tests * fix(execution): bound output and clean up cancelled sandbox startup * fix(tests): mock Seatbelt platform requirements on Linux * fix(home): block Git help helpers and harden sandbox cleanup * Fix sandbox runtime links and subprocess cleanup * ci: cover Home plugin tests * test: wait for pipeline descendants to exit after cancellation * fix: align Home dependencies and preserve cleanup cancellation Require ReMe 0.4.2.1 and verify isolated Home wheel installation in package CI. Share cancellation-safe cleanup with thread calls, retain AnyIO cancellation semantics, and record Bubblewrap mount targets during argument construction.	2026-10-27 18:08:26 +08:00