feat: add --security-mode strict|compat with strict as default - #6197

Merged

lpcox merged 11 commits into

mainfrom

feat/security-mode-strict

Jul 13, 2026

Commits on Jul 13, 2026

feat: add --security-mode strict|compat with strict as default

lpcox
and
Copilot
committed
af1ddf0
fix: add --security-mode compat to runWithSudo() in test fixture

lpcox
and
Copilot
committed
afa85ff
test: migrate chroot integration tests to strict security mode

lpcox
and
Copilot
committed
439c0cc
fix: address security-mode review feedback
Copilot
authored
a054279
fix: clear allowHostPorts when strict mode overrides enableHostAccess

lpcox
and
Copilot
committed
c79b6b5
test: migrate 24 integration tests to strict security mode

lpcox
and
Copilot
committed
d0294fe
ci: remove sudo from AWF invocations in lock files

lpcox
and
Copilot
committed
534a612
ci: remove --enable-host-access from 9 lock files

lpcox
and
Copilot
committed
218bb61
revert: remove lock file changes (need AWF release first)

lpcox
and
Copilot
committed
5bc0320
test: migrate dns-servers tests to strict mode using dig

lpcox
and
Copilot
committed
de308f4
test: enforce credential isolation in token tests

lpcox
and
Copilot
committed
3e76487