fix(security): isolate gateway process from sandbox agent - #721

Merged

ericksoa merged 34 commits into

mainfrom

fix/gateway-process-isolation

Mar 24, 2026

Commits on Mar 22, 2026

fix(install): prevent nvm/login shell from resetting PATH in subshells

cv
and
claude
committed
8c79539

Commits on Mar 23, 2026

Merge remote-tracking branch 'upstream/main' into fix/install-subshell-helpers
cv
committed
d8a77d2
fix(ci): drop stray '.' arg from pyright pre-push hook

cv
and
claude
committed
0c03d96
chore: apply shfmt formatting to shell scripts

cv
and
claude
committed
5675007
fix(ci): exclude test files from pyright strict type-checking

cv
and
claude
committed
350cba0
fix(ci): drop stray '.' arg from pyright in blueprint Makefile

cv
and
claude
committed
e2b955b
fix(security): isolate gateway process from sandbox agent
ericksoa
committed
e6cc705
Merge remote-tracking branch 'origin/main' into fix/install-subshell-helpers
cv
committed
c8b8247
chore: apply shfmt formatting to brev-setup.sh

cv
and
claude
committed
63b0d72
fix(security): harden entrypoint against symlink injection, PATH hijacking, and log tampering
ericksoa
committed
72d7d3a
fix(security): pin apt and pip package versions in Dockerfile

cv
and
claude
committed
f02d161
fix: address CodeRabbit review feedback on gateway isolation
ericksoa
committed
c7cd3bf
chore: merge upstream/main and resolve conflicts

cv
and
claude
committed
e80dbf0
test: add E2E test for gateway process isolation (10 checks)
ericksoa
committed
cf56a34
fix: remove hadolint ignore and quote pyyaml version pin

cv
and
claude
committed
24821c8
fix: prevent infinite recursion when openshell passes nemoclaw-start as command arg
ericksoa
committed
88f98ce
fix: document -h short alias in usage output

cv
and
claude
committed
2f0bf3b
fix: suppress hadolint DL3002 — root USER is intentional for gosu privilege separation
ericksoa
committed
006a916
Merge branch 'pr-651-temp' into fix/gateway-process-isolation
ericksoa
committed
9614a44
chore: consolidate apt-get layers (merge gosu into main install)
ericksoa
committed
46a822f

Commits on Mar 24, 2026