All pull requests

Pull requests

• windows: name the runner the sandbox user cannot read

  #794·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• windows: start a sandbox from session 0 without a session folder grant

  #793·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• windows: quote the CLI's argv for cmd.exe, not a POSIX shell

  #792·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• fix(macos): expand write denies in both spellings and check structural glob containment

  #791·inanna-malick opened Oct 29, 2026·

  ·
  1

  7

• fix(violations): honor zero and nonpositive tail limits

  #789·BlackRonin-coder opened Oct 28, 2026·

  ·

• The file RIPGREP_CONFIG_PATH names is a mandatory write deny

  #786·veljjanoski opened Oct 26, 2026·

  ·
  1

• windows: srt-win.exe runs without the VC++ Redistributable

  #785·veljjanoski opened Oct 26, 2026·

  ·
  1

• fix(http-proxy): drain CONNECT tunnel on normal origin close and set nodelay

  #781·reginaldalfret opened Oct 24, 2026·

  ·
  1

• docs: clarify argv-style CLI invocation

  #780·zhdaniel opened Oct 24, 2026·

  ·

• windows: try the next proxy port on EACCES

  #777·hamza-paracha opened Oct 24, 2026·

  ·
  1

  1

• proxy: rsync gets the proxy credential in RSYNC_PROXY

  #770·luiacuaniello opened Oct 23, 2026·

  ·

• proxy: an allow-listed private address is reached through the proxy

  #769·luiacuaniello opened Oct 23, 2026·

  ·

• windows: document what a deny on a missing path leaves on disk

  #768·ken-jo opened Oct 23, 2026·

  ·

• windows: narrow the profile read grant to a listed set

  #767·ig-ant opened Oct 22, 2026Collaborator·

  ·

• windows: opt-in MXC BaseContainer backend

  #766·ig-ant opened Oct 21, 2026Collaborator·

  ·

• fix(linux): harden CLI and network bridge lifetimes

  #763·EliasCodeFI opened Oct 21, 2026·

  ·

• test: require client evidence in network-denial checks

  #762·EliasCodeFI opened Oct 21, 2026·

  ·

• fix(tls-terminate): route outbound upstream leg through parent proxy

  #759·reginaldalfret opened Oct 21, 2026·

  ·
  1

• test: require workload evidence in sandbox boundary checks

  #758·EliasCodeFI opened Oct 21, 2026·

  ·

• Upgrade to MXC SDK 1.0.0 (PR #640 on 1.0.0)

  #757·ig-ant opened Oct 20, 2026Collaborator·

  ·

• linux: mount points hold across hosts that share a home

  #753·ronleizrowice-ant opened Oct 20, 2026Collaborator·

  ·
  

• Draft, not for merging: six pull requests merged together

  #751·ronleizrowice-ant opened Oct 20, 2026Collaborator·

  ·
  1

  

• macOS: denyMachLookup denies a lookup after every allow

  #741·connebs opened Oct 17, 2026·

  ·

• linux: a write deny that leads to a name that is no text lets the command start

  #737·dylan-conway opened Oct 16, 2026Collaborator·

  ·

• proxy: the ask callback is told which invocation asked

  #735·ken-jo opened Oct 16, 2026·

  ·
  1