feat(cef): real Linux sandbox-enable attempt (no_sandbox=false) - #404

Closed

qnbs wants to merge 18 commits into

mainfrom

feat/cef-wave2-sandbox-enable-attempt1

Commits on Aug 19, 2026

feat(cef): real Linux sandbox-enable attempt (no_sandbox=false)

qnbs
and
claude
committed
44bad43
fix(cef): assert no sandbox-weakening flags on the real process command line

qnbs
and
claude
committed
952996a
fix(cef): real root cause of the sandboxed-launch failure + harness hardening

qnbs
and
claude
committed
f2a034f
research(cef): isolate whether Yama ptrace_scope blocks Crashpad under the real sandbox

qnbs
and
claude
committed
ff87752
research(cef): separate sandbox-enforcement evidence from Crashpad regression, add real diagnostics

qnbs
and
claude
committed
0d3914b
research(cef): capture NSpid + event-driven snapshot for the PID-namespace-mismatch hypothesis

qnbs
and
claude
committed
205c03b
research(cef): compare real pid-ns identity, not just NSpid nesting depth

qnbs
and
claude
committed
eb0bd6d
research(cef): add PPid/ns/pid_for_children capture + browser-vs-handler pid-ns comparison

qnbs
and
claude
committed
f00022f
fix(cef): three real diagnostic-harness bugs caught in review before trusting its evidence

qnbs
and
claude
committed
3c08bf0
fix(cef): correct handler identity — --type= authoritative, cmdline substring unsafe

qnbs
and
claude
committed
3fae0f8
fix(cef): handle Chromium's argv-rewrite for zygote-forked children in cmdline parsing

qnbs
and
claude
committed
1abf94e
feat(cef): promote sandbox-status proof to a real renderer-specific acceptance test

qnbs
and
claude
committed
826253f
docs(cef): reconcile Wave 2 docs with real sandbox-enable + Crashpad regression evidence

qnbs
and
claude
committed
ae45ac7
fix(cef): address CodeRabbit nitpicks — bound summary output, scope browser comparison

qnbs
and
claude
committed
b8b7bcf
fix(cef): correct future-dated evidence records + scope handlers by hostMatched too

qnbs
and
claude
committed
08b2dab
fix(cef): correct chrome-sandbox invocation overclaim across all docs

qnbs
and
claude
committed
3dfc711
fix(cef): real fix attempt for renderer-crash-dump-under-sandbox (R-19)

qnbs
and
claude
committed
2812775
research(cef): real root-cause-informed --no-zygote experiment for R-19

qnbs
and
claude
committed
7764659

Navigation Menu

feat(cef): real Linux sandbox-enable attempt (no_sandbox=false) - #404

feat(cef): real Linux sandbox-enable attempt (no_sandbox=false)#404
qnbs wants to merge 18 commits into
mainfrom
feat/cef-wave2-sandbox-enable-attempt1

Commits on Aug 19, 2026

feat(cef): real Linux sandbox-enable attempt (no_sandbox=false)

fix(cef): assert no sandbox-weakening flags on the real process command line

fix(cef): real root cause of the sandboxed-launch failure + harness hardening

research(cef): isolate whether Yama ptrace_scope blocks Crashpad under the real sandbox

research(cef): separate sandbox-enforcement evidence from Crashpad regression, add real diagnostics

research(cef): capture NSpid + event-driven snapshot for the PID-namespace-mismatch hypothesis

research(cef): compare real pid-ns identity, not just NSpid nesting depth

research(cef): add PPid/ns/pid_for_children capture + browser-vs-handler pid-ns comparison

fix(cef): three real diagnostic-harness bugs caught in review before trusting its evidence

fix(cef): correct handler identity — --type= authoritative, cmdline substring unsafe

fix(cef): handle Chromium's argv-rewrite for zygote-forked children in cmdline parsing

feat(cef): promote sandbox-status proof to a real renderer-specific acceptance test

docs(cef): reconcile Wave 2 docs with real sandbox-enable + Crashpad regression evidence

fix(cef): address CodeRabbit nitpicks — bound summary output, scope browser comparison

fix(cef): correct future-dated evidence records + scope handlers by hostMatched too

fix(cef): correct chrome-sandbox invocation overclaim across all docs

fix(cef): real fix attempt for renderer-crash-dump-under-sandbox (R-19)

research(cef): real root-cause-informed --no-zygote experiment for R-19