fix(studio): harden sandbox security for terminal and python tools#4827

Merged

danielhanchen merged 22 commits into

mainfrom

fix/studio-sandbox-hardening

Apr 3, 2026

Commits on Apr 3, 2026

fix(studio): harden sandbox security for terminal and python tools
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Fix review findings: exception_catching dead code, false positives, process substitution
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Address review feedback: regex paths, keyword args, list element scanning
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Fix nested shell scan to only check the script body, not positional args
danielhanchen
committed
Add subshell parentheses to regex command boundary detection
danielhanchen
committed
Address high-priority review findings from 7 parallel reviewers
danielhanchen
committed
Fix false positive on check=True kwargs and recursive nested shell scanning
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Move preexec_fn imports to module level and use find_library for libc
danielhanchen
committed
Apply Gemini style suggestions: combined regex, dict.fromkeys, constant hoisting
danielhanchen
committed
Add cmd /c nested shell detection for Windows parity
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Handle combined shell flags (-lc, -xc) and interleaved flags (--login -c)
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Fix /bin/bash bypass, remove RLIMIT_NPROC, reduce AST false positives
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed
Handle Windows drive letter paths and .exe extensions in command detection
danielhanchen
committed
Handle **kwargs dict expansion, non-literal shell=, and except Exception false positive
danielhanchen
committed
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot]
committed