All pull requests

Pull requests

• fix(macos): wait for the sandbox log monitor to close during reset

  #814·xunguangzlj-cloud opened Nov 8, 2026·

  ·
  1

• linux: network.reachHostPorts, a direct path to chosen host loopback ports

  #813·carlostapiacl opened Nov 8, 2026·

  ·

• feat(network): accept IP literals and CIDR ranges in allowedDomains / deniedDomains

  #807·mike2307 opened Nov 3, 2026·

  ·
  1

  1

• tls: keep CA signing material out of sandboxed processes

  #802·iainlane opened Nov 1, 2026·

  ·

• proxy: an allow decision can observe the response body

  #799·thomaslwang opened Oct 31, 2026·

  ·

• Linux: allowUnixSocketCreation keeps the seccomp helper

  #797·tappress opened Oct 30, 2026·

  ·
  1

  1

• windows: name the runner the sandbox user cannot read

  #794·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• windows: start a sandbox from session 0 without a session folder grant

  #793·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• windows: quote the CLI's argv for cmd.exe, not a POSIX shell

  #792·TurtIeSocks opened Oct 30, 2026Contributor·

  ·

• fix(macos): expand write denies in both spellings and check structural glob containment

  #791·inanna-malick opened Oct 29, 2026·

  ·
  1

  7

• fix(violations): honor zero and nonpositive tail limits

  #789·BlackRonin-coder opened Oct 28, 2026·

  ·

• The file RIPGREP_CONFIG_PATH names is a mandatory write deny

  #786·veljjanoski opened Oct 26, 2026·

  ·
  1

• windows: srt-win.exe runs without the VC++ Redistributable

  #785·veljjanoski opened Oct 26, 2026·

  ·
  1

• fix(http-proxy): drain CONNECT tunnel on normal origin close and set nodelay

  #781·reginaldalfret opened Oct 24, 2026·

  ·
  1

• docs: clarify argv-style CLI invocation

  #780·zhdaniel opened Oct 24, 2026·

  ·

• windows: try the next proxy port on EACCES

  #777·hamza-paracha opened Oct 24, 2026·

  ·
  1

  1

• proxy: rsync gets the proxy credential in RSYNC_PROXY

  #770·luiacuaniello opened Oct 23, 2026·

  ·
  1

• proxy: an allow-listed private address is reached through the proxy

  #769·luiacuaniello opened Oct 23, 2026·

  ·
  1

• windows: document what a deny on a missing path leaves on disk

  #768·ken-jo opened Oct 23, 2026·

  ·

• fix(tls-terminate): route outbound upstream leg through parent proxy

  #759·reginaldalfret opened Oct 21, 2026·

  ·
  1

• Upgrade to MXC SDK 1.0.0 (PR #640 on 1.0.0)

  #757·ig-ant opened Oct 20, 2026Collaborator·

  ·

• linux: mount points hold across hosts that share a home

  #753·ronleizrowice-ant opened Oct 20, 2026Collaborator·

  ·
  

• Draft, not for merging: seven pull requests merged together

  #751·ronleizrowice-ant opened Oct 20, 2026Collaborator·

  ·
  2

  

• macOS: denyMachLookup denies a lookup after every allow

  #741·connebs opened Oct 17, 2026·

  ·

• linux: a write deny that leads to a name that is no text lets the command start

  #737·dylan-conway opened Oct 16, 2026Collaborator·

  ·