Michael Bolin d824faf0dc Move workspace roots onto thread/session state and stop using active permission profile modifications as an overlay for writable roots. Existing app-server threads now preserve their persisted PermissionProfile value across resume, fork, and turn updates; permissions requests on existing threads only update the active named profile after validating it exists. Workspace roots can be updated independently, and SandboxPolicy::WorkspaceWrite no longer stores its own writable_roots.

2026-05-11 19:06:28 -07:00

..

landlock.rs

Move workspace roots onto thread/session state and stop using active permission profile modifications as an overlay for writable roots. Existing app-server threads now preserve their persisted PermissionProfile value across resume, fork, and turn updates; permissions requests on existing threads only update the active named profile after validating it exists. Workspace roots can be updated independently, and SandboxPolicy::WorkspaceWrite no longer stores its own writable_roots.

2026-05-11 19:06:28 -07:00

managed_proxy.rs

linux-sandbox: use standalone bundled bwrap (#21255)

2026-05-05 17:14:29 -07:00

mod.rs

feat(linux-sandbox): implement proxy-only egress via TCP-UDS-TCP bridge (#11293)

2026-02-21 18:16:34 +00:00