SoulterandRuochenPan 06261c532a feat: add role-based Local computer permissions (#9472) ...

* feat: sandbox local member execution on Linux

* feat: add macOS Seatbelt local sandbox

* feat: Implement race-resistant file access for local tools

- Added `open_file_in_allowed_roots` function in `local_file_security.py` to securely open files within specified directories, preventing path traversal attacks.
- Updated file reading functions in `file_read_utils.py` to accept file descriptors, allowing for safer file operations.
- Enhanced `FileReadTool`, `FileWriteTool`, and `FileEditTool` to utilize the new secure file access method.
- Added tests to ensure restricted access works correctly, including scenarios with symlinked directories and ancestor swaps.
- Improved error handling for file operations to provide clearer feedback on permission issues.

* feat: add role-based Local computer permissions

* fix: clarify Windows Local permission behavior

* style: use neutral permission matrix border

* fix: clarify Local runtime permission labels

* fix: localize computer runtime options

* fix: tighten default Local permission policy

* fix: allow macOS sandboxed shell forks

* refactor: extract platform process sandboxes

* refactor: expose cross-platform sandbox limits

* refactor: unify sandbox process lifecycle

* refactor: seal local sandbox abstractions

* test: align local sandbox tests with Windows support

* fix: improve local permission settings layout

* fix: initialize workspace for restricted file writes

* feat: expose runtime and sandbox dependency information

* feat: add disabled local access and platform-aware permission controls

* feat: display runtime information in local permission controls

* fix: validate local permission support before saving config

* fix: use supported local permission defaults on Windows

* fix: restrict local file sending and align Windows permission tests

* chore: remove redundant local permission hint

* fix: restore local sandbox DNS and approved file access

* ci: enable bubblewrap user namespaces on Ubuntu runners

* fix: report local sandbox startup failures

* fix: use a portable sandbox startup probe

* fix: preserve read-only Python virtualenv access in local sandboxes

* fix: revoke local shell sessions when permissions change

* fix: block shared-path attacks on local runtime file exchange

Sandboxed processes can write to shared temp roots, so a named session
log there could be replaced with a symlink to a host file that host-side
reads and appends would follow. Keep managed shell output on an anonymous
temporary file handle instead of a named path.

Also stop _resolve_path_from_sandbox from consulting a booter under the
local runtime: workspace and local-file checks already enforce caller
permissions, and the fallback branch probed the host shell without them.
Reject such paths with FileNotFoundError instead.

* fix: revoke local shell sessions when admin access is removed

* fix: skip missing default roots in local grep

* test: check sandbox file readability across platforms

* test: wait for watchdog retry without fixed sleeps

* test: synchronize watchdog log rotation assertions

---------

Co-authored-by: RuochenPan <badbatch0x01@gmail.com>

2026-09-15 15:48:01 +08:00

..

config.yaml

chore: update gitignore, Makefile, skills route, and test scaffolding

2026-02-16 02:38:01 +08:00

openapi-v1.yaml

feat: add role-based Local computer permissions (#9472)

2026-09-15 15:48:01 +08:00