fix(sandbox): isolate Windows temp capabilities

2026-08-10 15:31:38 +08:00
parent 9a3c89d04a
commit fd650af340
30 changed files with 744 additions and 596 deletions
@@ -559,6 +559,7 @@ describe('sandbox escalation through ctx.approval', () => {
    expect(properties['sandbox_permissions']?.enum).toEqual(['workspace-write', 'danger-full-access'])
    expect(schema.description).toContain('approval prompt')
    expect(schema.description).toContain('ConstrainedLanguage')
+    expect(schema.description).toContain('workspace-write stays in FullLanguage')
    expect(schema.description).toContain('named pipes')
    expect(schema.description).toContain('fails with EPERM')