mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-15 23:32:46 +00:00
ab3ef9371a
fabro-sandbox kept its own sanitize_exec_output, a character walker that removed ANSI escape sequences and control characters from a command's output tail after redaction. The sandbox driver already offers this as ExecSpec::output_sanitization, applied chunk-safely to buffered and streaming output, so fabro carried a second, weaker copy of the same logic that only ran on the rendered tail and never on the streams the agent, the command stage, or the sink consumers read. SandboxExec::apply_policy now sets OutputSanitization::StripAll on any spec still at the driver's raw default, so every run and run_streaming call through fabro's exec policy returns text with escape sequences and stray control characters already removed. A caller that chose another policy keeps it. spawn_stdio is untouched: long-lived stdio processes stay raw, as the driver requires. redacted_tail now only redacts secrets and applies the byte cap, which remain fabro's knowledge, and the private sanitizer is gone. The tail test that built an ExecResult by hand now runs a printf through the Host provider and checks that the stripped output reaches both the result and the tail, and a new test pins the policy's default and its respect for an explicit choice. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| apps | ||
| components | ||
| foundation | ||
| packages/fabro-api-client | ||