Skip to content

fix(studio): harden sandbox security for terminal and python tools #4827

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
danielhanchen merged 22 commits into from
Apr 3, 2026
Merged

fix(studio): harden sandbox security for terminal and python tools #4827

Changes from 13 commits
Commits
Show all changes
22 commits
Select commit Hold shift + click to select a range
27b5b72
fix(studio): harden sandbox security for terminal and python tools
danielhanchen Apr 3, 2026
df7d0a5
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
48c9161
Fix review findings: exception_catching dead code, false positives, p…
danielhanchen Apr 3, 2026
0653126
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
64912fb
Address review feedback: regex paths, keyword args, list element scan…
danielhanchen Apr 3, 2026
32c7d34
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
4098e53
Fix nested shell scan to only check the script body, not positional args
danielhanchen Apr 3, 2026
9f76910
Add subshell parentheses to regex command boundary detection
danielhanchen Apr 3, 2026
1befb8f
Address high-priority review findings from 7 parallel reviewers
danielhanchen Apr 3, 2026
346b1dc
Fix false positive on check=True kwargs and recursive nested shell sc…
danielhanchen Apr 3, 2026
0324979
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
e2deca7
Move preexec_fn imports to module level and use find_library for libc
danielhanchen Apr 3, 2026
57ca437
Apply Gemini style suggestions: combined regex, dict.fromkeys, consta…
danielhanchen Apr 3, 2026
57e530c
Add cmd /c nested shell detection for Windows parity
danielhanchen Apr 3, 2026
d029e2f
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
a9ab191
Handle combined shell flags (-lc, -xc) and interleaved flags (--login…
danielhanchen Apr 3, 2026
539dc64
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
037b771
Fix /bin/bash bypass, remove RLIMIT_NPROC, reduce AST false positives
danielhanchen Apr 3, 2026
e35e8a0
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
ac7cb80
Handle Windows drive letter paths and .exe extensions in command dete…
danielhanchen Apr 3, 2026
e5219a1
Handle **kwargs dict expansion, non-literal shell=, and except Except…
danielhanchen Apr 3, 2026
83de70d
[pre-commit.ci] auto fixes from pre-commit.com hooks
pre-commit-ci[bot] Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading
Loading