KRATOSandClaude Opus 4.8 a9655a6ad3 audit2: sandbox + sessions fixes (2 high, 2 med, 6 low) ...

sandbox: quoted-root rm -rf bypass (HIGH); interactive-detector quote/escape-in-token + segment-boundary false positives; chmod single-file not destructive. sessions: Fork copies checkpoint blobs so fork rewind works (HIGH); ApplyRewind atomic under one lock; pruneOrphanBlobs+capture race fixed under lock (verified real); restore preserves file mode; size-cap int64 (no 32-bit overflow); sessionLocks growth documented. TDD incl -race; build/vet/full-suite green.

Refs #102

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-06-07 09:41:38 +05:30

..

checkpoint_test.go

address PR #101 review (CodeRabbit): registry validation + test error checks

2026-06-07 08:33:14 +05:30

checkpoint.go

audit2: sandbox + sessions fixes (2 high, 2 med, 6 low)

2026-06-07 09:41:38 +05:30

exec_session.go

feat: add Go headless protocol sessions (#60)

2026-06-05 10:41:38 +05:30

filelock_other.go

audit fixes: sandbox + sessions (H2,H3,H4,M5,M6,M7 + lows)

2026-06-07 01:51:25 +05:30

filelock_unix.go

audit fixes: sandbox + sessions (H2,H3,H4,M5,M6,M7 + lows)

2026-06-07 01:51:25 +05:30

lineage.go

fix: address session lineage review feedback

2026-06-05 15:48:11 +05:30

replay_test.go

Add runtime permission and verification event contracts (#82)

2026-06-06 13:13:08 +05:30

replay.go

feat: add runtime permission decisions (#95)

2026-06-06 15:26:33 +05:30

rewind_test.go

audit2: sandbox + sessions fixes (2 high, 2 med, 6 low)

2026-06-07 09:41:38 +05:30

rewind.go

audit2: sandbox + sessions fixes (2 high, 2 med, 6 low)

2026-06-07 09:41:38 +05:30

store_test.go

feat: add Go session lineage backend

2026-06-05 15:48:11 +05:30

store.go

audit2: sandbox + sessions fixes (2 high, 2 med, 6 low)

2026-06-07 09:41:38 +05:30