fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade - #886

Open

Vasanthdev2004 wants to merge 40 commits into

mainfrom

fix/windows-restricted-sid-invariant

Commits on Aug 29, 2026

fix(sandbox): guard the Windows write-jail invariant and disclose the DenyRead trade
Vasanthdev2004
committed
badad72
fix(sandbox): only warn about the DenyRead token trade on a Windows host
Vasanthdev2004
committed
e32d467
fix(sandbox): stop advertising a sandbox override that does not exist
Vasanthdev2004
committed
6f3e95a
test(sandbox): pin the remedies the unelevated ACL failure offers
Vasanthdev2004
committed
a64a2d1
test(sandbox): fail rather than skip when the DenyRead token loses the World SID
Vasanthdev2004
committed
993e83d
fix(sandbox): disclose the DenyRead write-jail trade on the execution path
Vasanthdev2004
committed
c4c2588
fix(sandbox,tools): make the DenyRead disclosure reach a human, and project enforcement once
Vasanthdev2004
committed
58decfa
fix(sandbox,plugins,hooks): disclose the write-jail trade where it actually happens
Vasanthdev2004
committed
a9a54ce
fix(plugins,hooks): carry the disclosure through every post-launch outcome
Vasanthdev2004
committed
3fbf794
test(sandbox): pin the notice projection itself, not just its consumers
Vasanthdev2004
committed
95b99d5
fix(agent): carry one canonical representation of a tool result across the projection
Vasanthdev2004
committed
2bbcac1
fix(acp,cli): carry the enforcement notice to the consumers the projection left behind
Vasanthdev2004
committed
dd8679b
fix(execution): one launch-state decision, and disclose it on the MCP boundary
Vasanthdev2004
committed
b3394e7
fix(mcp,hooks): carry the enforcement fact to the durable consumers
Vasanthdev2004
committed
7c38b2f
fix(mcp): collect startup disclosures in the serial phase, and keep them past a failed start
Vasanthdev2004
committed
f1134c7
fix(cli): report MCP startup disclosures from headless exec
Vasanthdev2004
committed
510b00a
fix(execution): record launch state instead of inferring it from the outcome kind
Vasanthdev2004
committed
fb08fec
fix(mcp): carry the launch disclosure through an initialize failure
Vasanthdev2004
committed
e5f060d
fix(tools): derive command notices from applied execution state, not the plan
Vasanthdev2004
committed
3e01a1f
fix(sandbox): gate the DenyRead diagnostic on the resolved plan
Vasanthdev2004
committed
5e338c4
fix(tui): show the enforcement disclosure in cards and after resume
Vasanthdev2004
committed
7050df8
fix(tools): measure the model output the enforcement notices are part of
Vasanthdev2004
committed
4338cde
test(sandbox): fail when the current-user SID prerequisite cannot be read
Vasanthdev2004
committed
3d43795
fix(mcp): keep the launch disclosure when registration times out
Vasanthdev2004
committed
5e90e04
fix(tools): carry bash's real launch state into the shared outcome
Vasanthdev2004
committed
6e181c9
fix(mcp): synchronize the timeout with a start that is still completing
Vasanthdev2004
committed
dc723e6

Commits on Aug 31, 2026

Commits on Sep 2, 2026

Commits on Sep 3, 2026

Commits on Sep 4, 2026