Yichen Jiang 9626c15c6b test(sandbox): carry the resolved read denials through consumer policy assertions ...

The policy home's resolve() now stamps readDenyPaths, so every consumer
that pins the resolved shape (bash-sandbox hand-off, tool-fs stamps)
carries it, and three uncovered branches gained real tests: landlock
reporting partial enforcement for a denial it cannot express, the
policy's default under programmatic construction, and both ambient
credential paths in llm-deepseek without a mounted seam.

2026-07-30 16:11:21 +08:00

4.3 KiB

Raw Blame History

View Raw