CoreRasurae fe5941bf3c fix(agents): enforce sandbox containment inside FileAccessCore itself ...

Further review found that InlineFileHelperFactory.build's read_file/
write_file closures close over the FileAccessCore instance, and
FileAccessCore.write/read_window performed no containment check of their
own -- by design, per D-2's original division of labor. Inline code could
reach the closed-over core via read_file.__closure__[0].cell_contents (or
the equivalent for write_file) and call core.write(...)/core.read_window(...)
directly, bypassing SandboxRootPolicy entirely -- the same class of bypass
as the bound-method __self__ leak already fixed, reached through a
different introspection path.

FileAccessCore.read_window/write now accept a keyword-only confine: bool =
True parameter. When true (the default), the method resolves path through
the root policy itself before touching disk. The inline-code read_file
closure passes confine=safe_mode; write_file passes confine=False (it only
reaches the core after safe_mode has already refused); the built-in
_file_read_tool/_file_write_tool pass confine=False, since they perform
their own admission checks that intentionally permit escaping the sandbox
root in the tools' own unsafe mode. Any caller that reaches the core without
specifying confine -- including via closure introspection -- now lands on
the safe default.

Adds ADR-2035 D-8 recording the decision, a Behave scenario proving the
closure-introspection path is closed, and adjusts the ASV read-window
benchmarks to pass confine=False explicitly so they keep measuring pure I/O
in isolation from the already-dedicated resolve benchmark.

Refs: #93

2026-08-06 17:32:02 +00:00

..

mocks

test(langgraph): capture parallel dispatch node-flag regression (#97)

2026-08-05 23:58:28 +01:00

steps

fix(agents): enforce sandbox containment inside FileAccessCore itself

2026-08-06 17:32:02 +00:00

actor_result_token_counting.feature

feat(ActorResult): implement ActorResult and NodeUsage types; capture per-node token counts from LangChain responses

2026-06-11 03:05:20 +00:00

agent_modules_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

agent_skills.feature

feat(skills): add skill package schema and agent-side skill loading support

2026-08-04 07:14:15 +01:00

agent_templates_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

agents_base_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

agents_base_final_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

application_core_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

application_coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

application_direct_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

application_interactive_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

application_missing_lines_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

application_utilities.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

bridge_coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

bridge_final_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

bridge_remaining_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

bridge_source_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

cache_coverage.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

chain_agent_comprehensive.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

complex_templates.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

composite_agent_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

config_core_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

config_module_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

config_parser_comprehensive_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

config_parser_coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

config_parser_missing_lines_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

config_specific_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

configuration_management.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

context_manager.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

coverage_final.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

credential_executor_validation.feature

feat(credentials): refactor LLMAgent/AgentFactory for per-request credential injection and extended provider routing

2026-06-08 11:10:46 +00:00

credential_injection.feature

fix(llmagent): do not close shared cached httpx clients in cleanup()

2026-06-17 17:19:44 +00:00

decorators_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

deferred_template_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

dynamic_router_coverage.feature

test(coverage): add BDD unit tests to close coverage gap toward 97%

2026-06-09 16:06:32 +01:00

enhanced_registry_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

environment.py

test(langgraph): capture content_not_contains edge condition regression (#95)

2026-08-04 09:49:02 +00:00

error_verbosity.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

execute_stream.feature

fix(graph): enforce USD budget at each agent invocation with pre-flight gate

2026-07-12 19:51:39 +01:00

execution_limits.feature

fix(graph): enforce USD budget at each agent invocation with pre-flight gate

2026-07-12 19:51:39 +01:00

final_coverage_push.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

graph_templates_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

graph_templates_direct_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

graph_tool_node_execution.feature

feat(langgraph): implement real type:tool graph node execution via ToolAgent dispatch

2026-07-09 14:06:59 +00:00

inline_code_file_helpers.feature

fix(agents): enforce sandbox containment inside FileAccessCore itself

2026-08-06 17:32:02 +00:00

inline_jinja_handler_direct.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

inline_jinja_handler_specific.feature.backup

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

inline_sandbox_import_restriction.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

inline_yaml_jinja_complete_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

inline_yaml_jinja_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

inline_yaml_jinja_coverage.feature.backup

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

inline_yaml_jinja_enhanced_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

jinja_yaml_preprocessor_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

jinja_yaml_preprocessor_focused.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

langgraph_agent_nodes.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_bridge_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

langgraph_bridge_direct_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

langgraph_conditional_routing.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_core_fixed.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_core.feature.disabled

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_graph_comprehensive.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_graph_edge_cases.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_graph_final_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_nodes_optimized.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

langgraph_rxpy_operator.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_state_management.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

langgraph_visualization.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

llm_agent_config_validation.feature

test(unit): increase BDD coverage to 97% for registry, LLM, YAML template error branches

2026-06-15 23:13:46 +01:00

llm_agent_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

llm_agent_retry.feature

feat(agents): add LLM agent retry mechanisms with exponential backoff

2026-07-03 16:00:11 +01:00

llm_agent_stream_tool_calls.feature

feat(agents): add tool-call support to LLMAgent.stream_message

2026-07-02 07:47:39 +00:00

llm_agent_tool_calling.feature

fix(actors): llm token consumption undercounted

2026-07-01 14:55:58 +01:00

llm_agent_tool_loop.feature

feat(skills): add skill package schema and agent-side skill loading support

2026-08-04 07:14:15 +01:00

llm_cleanup_shared_client.feature

fix(llmagent): do not close shared cached httpx clients in cleanup()

2026-06-17 17:19:44 +00:00

llm_imports_coverage.feature

feat(llm): route reasoning models to reasoning-aware provider clients

2026-08-05 22:00:08 +00:00

llm_missing_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

llm_provider_url_canonicalization.feature

test(unit): increase BDD coverage to 97% for registry, LLM, YAML template error branches

2026-06-15 23:13:46 +01:00

llm_system_prompt_context_rendering.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

llm_tools_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

massive_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

merge_configs.feature

feat(merge_configs): expose public merge_configs(*dicts) API per §3.1 deep-merge algorithm

2026-06-03 14:44:18 +00:00

network_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

nodes_coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

nodes_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

progress_coverage.feature

test(coverage): add BDD unit tests to close coverage gap toward 97%

2026-06-09 16:06:32 +01:00

pure_graph_content_not_contains.feature

fix(langgraph): implement content_not_contains condition in pure graph edge evaluator

2026-08-04 12:14:41 +00:00

pure_graph_coverage_gaps_v2.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

pure_graph_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

pure_graph_edge_target_validation.feature

fix(graph): reject edges targeting unknown nodes during validation

2026-08-04 20:15:28 +01:00

pure_graph_parallel_node_gate.feature

fix(langgraph): gate pure graph concurrent node dispatch on per-node parallel flag

2026-08-06 11:55:03 +00:00

reactive_agents.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

reactive_application.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

reactive_streams.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

reasoning_provider_routing.feature

feat(llm): route reasoning models to reasoning-aware provider clients

2026-08-05 22:00:08 +00:00

registry_cache.feature

feat(registry): implement RegistryCache with LRU eviction and TTL

2026-06-11 19:26:04 +01:00

registry_canonicalization.feature

feat(registry): implement Canonicalizer with NFC normalization and SHA-1 hashing

2026-06-10 11:33:50 +01:00

registry_core_types.feature

feat(registry): add PackageType, PackageId, PackageReference, PackageContent core types

2026-06-06 19:21:22 +01:00

registry_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

registry_exceptions.feature

feat(registry): implement RegistryError hierarchy with typed exceptions

2026-06-11 20:44:54 +01:00

registry_http_client.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

registry_local_store.feature

feat(registry): implement local namespace reference resolution

2026-06-12 17:11:35 +01:00

registry_reference_resolver_coverage.feature

feat(registry): extend TemplateType and integrate PackageReference into template system

2026-06-10 12:50:38 +01:00

registry_reference_resolver.feature

feat(registry): implement local namespace reference resolution

2026-06-12 17:11:35 +01:00

registry_resolver_errors.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

registry_template_integration.feature

feat(registry): implement local namespace reference resolution

2026-06-12 17:11:35 +01:00

road_to_97.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

route_bridge_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

route_coverage_comprehensive.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

route_graph_config_coverage.feature

test(coverage): add BDD unit tests to close coverage gap toward 97%

2026-06-09 16:06:32 +01:00

route_missing_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

routing_prefix_stripping.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

runtime_coverage.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

runtime_dispatch_coverage.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

runtime_extended_coverage.feature

feat(create_executor): implement create_executor() factory and Executor.execute() returning ActorResult

2026-06-10 09:41:39 +00:00

sandbox_root_policy.feature

feat(agents): expose sandboxed file helpers to inline code

2026-08-06 16:43:41 +00:00

shell_timeout_override.feature

feat(agents): allow per-invocation timeout override on shell/http tools

2026-08-05 13:12:56 +01:00

simple_loaders.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

smart_yaml_loader_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

state_comprehensive_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

state_missing_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

stderr_suppression.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

stream_router_advanced.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

stream_router_comprehensive.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

stream_router_coverage_gaps.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

stream_router_final_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

stream_templates_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

tdd_expected_fail.py

test(langgraph): capture content_not_contains edge condition regression (#95)

2026-08-04 09:49:02 +00:00

template_configurations.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

template_loaders_coverage.feature.disabled

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

template_renderer_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

template_store_coverage.feature

feat(registry): extend TemplateType and integrate PackageReference into template system

2026-06-10 12:50:38 +01:00

templates_base_coverage.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

templates_base_remaining.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

templates_coverage.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

tool_agent_class_injection.feature

feat(agents): add tool_agent_class parameter to AgentFactory and create_executor

2026-07-08 09:23:34 +00:00

tool_agent_context_updates.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

tool_agent_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

tool_agent.feature

feat(agents): allow per-invocation timeout override on shell/http tools

2026-08-05 13:12:56 +01:00

tool_coverage_gaps.feature

feat(agents): expose sandboxed file helpers to inline code

2026-08-06 16:43:41 +00:00

unified_routes.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

unit_json_sanitization.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

unit_tdd_expected_fail_policy.feature

test(langgraph): capture content_not_contains edge condition regression (#95)

2026-08-04 09:49:02 +00:00

unit_temperature_override.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

unit_tool_command_processing.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

validate_dict.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00

validation_actor_coverage.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

verbose_logging_levels.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_jinja_loader_specific.feature

test(coverage): add coverage scenarios for pre-existing code paths

2026-06-23 10:49:16 +01:00

yaml_preprocessor_comprehensive.feature

test: add coverage gap tests improving coverage from 81.4% to 96.90%

2026-06-02 20:02:01 +01:00

yaml_template_engine_comprehensive.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_engine_coverage_gaps.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_engine_missing_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_engine_specific_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_engine_targeted_coverage.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_engine.feature

style: apply end-of-file and whitespace fixes across feature files

2026-05-27 21:41:03 +00:00

yaml_template_non_dict_errors.feature

test(unit): increase BDD coverage to 97% for registry, LLM, YAML template error branches

2026-06-15 23:13:46 +01:00

yte_remaining_coverage.feature

test(agents): capture inline sandbox __import__ escape regression (#107)

2026-08-06 14:31:11 +00:00