viettranx a4a7a59b6a fix(sandbox): path isolation, DooD volume mounting, hints, and nginx DNS (#129, #136) ...

Address issues identified in PR #137 with a cleaner approach:

- Sandbox isolation: add SandboxCwd/ResolveSandboxPath helpers to map
  filesystem tool paths to agent-scoped container subdirectories,
  preventing cross-agent file access via read/write/edit/list tools
- DooD volume mounting: add resolveHostWorkspacePath with multi-strategy
  container ID detection (/proc/self/mountinfo, HOSTNAME, os.Hostname)
  and 5s timeout on docker inspect
- Sandbox hints: expand from 1 pattern (binary not found) to 6 patterns
  (permission denied, network disabled, read-only FS, missing file,
  resource limits) with MaybeFsBridgeHint for filesystem tools
- Nginx DNS: add Docker resolver (127.0.0.11) with dynamic upstream
  variable to handle backend container IP changes
- MCP args: switch from comma-separated to space-separated parsing
  with quote support for --flag="value with spaces" patterns
- Refactor: rename ExecTool.workingDir to workspace for consistency,
  extract sandbox.DefaultContainerWorkdir constant

2026-03-20 07:32:23 +07:00

..

docker_resolve.go

fix(sandbox): path isolation, DooD volume mounting, hints, and nginx DNS (#129, #136)

2026-03-20 07:32:23 +07:00

docker_test.go

feat: Introduce Docker-based sandboxing with container lifecycle management, execution, pruning, and core sandbox interfaces.

2026-02-26 16:45:45 +07:00

docker.go

fix(sandbox): path isolation, DooD volume mounting, hints, and nginx DNS (#129, #136)

2026-03-20 07:32:23 +07:00

fsbridge.go

feat: enhance filesystem security with symlink/hardlink protection, implement typing indicators, and improve scheduler queue management for stale requests.

2026-02-26 22:47:59 +07:00

sandbox.go

fix(sandbox): path isolation, DooD volume mounting, hints, and nginx DNS (#129, #136)

2026-03-20 07:32:23 +07:00