Why: Q2 ruled exec tools stay disabled for now but code execution must return later; the recovery path treats model-generated code as untrusted. This abstracts the interpreter launch point (exec_interpreter.go runInterpreter) into an ExecBackend port: direct = byte-identical status quo, sandbox = bwrap isolation (ro system root, tmpfs over /home and /tmp, session-dir and skills-dir only mounts, --unshare-all no network, ulimit -u 256 fork cap, timeout kills the whole namespace).
Evidence: go test ./... 32/32 green; local escape negatives (bwrap 0.11.1, skip-guarded in CI): home secret unreadable, sibling session unreadable, network blocked, 400-process spawn storm capped (fork: retry), 60s sleep killed at 3s, orphans die with namespace; session-dir write visible on host; direct regression texts unchanged (exit=7 / exit=timeout). Full log in the task card evidence rows.
Impact: config execBackend key + AGENT_SYSTEM_EXEC_BACKEND + --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental); link pass-through; app.Run validates fail-closed. run_shell/run_python only — workflow ScriptCommand and squad ExecConfig stay direct (follow-up). DisableExecTools stays top priority.
Why: Q2 ruled exec tools stay disabled for now but code execution must return later; the recovery path treats model-generated code as untrusted. This abstracts the interpreter launch point (exec_interpreter.go runInterpreter) into an ExecBackend port: direct = byte-identical status quo, sandbox = bwrap isolation (ro system root, tmpfs over /home and /tmp, session-dir and skills-dir only mounts, --unshare-all no network, ulimit -u 256 fork cap, timeout kills the whole namespace).
Evidence: go test ./... 32/32 green; local escape negatives (bwrap 0.11.1, skip-guarded in CI): home secret unreadable, sibling session unreadable, network blocked, 400-process spawn storm capped (fork: retry), 60s sleep killed at 3s, orphans die with namespace; session-dir write visible on host; direct regression texts unchanged (exit=7 / exit=timeout). Full log in the task card evidence rows.
Impact: config execBackend key + AGENT_SYSTEM_EXEC_BACKEND + --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental); link pass-through; app.Run validates fail-closed. run_shell/run_python only — workflow ScriptCommand and squad ExecConfig stay direct (follow-up). DisableExecTools stays top priority.
Refs: proposal 2026-10-09-ext-g1-b1-b3-exec-backend.md §4 (EXT-16, G2-8 prototype); Backend #110.
Why: Q2 ruled exec tools stay disabled for now but code execution must
return later; the recovery path treats model-generated code as
untrusted. This abstracts the interpreter launch point in
exec_interpreter.go into an ExecBackend port (direct = byte-identical
status quo; sandbox = bwrap isolation) so downstream products can
re-enable execution behind isolation without further base surgery.
Evidence: go build/vet clean; go test ./... 32/32 packages green;
sandbox escape negatives all blocked locally (bwrap 0.11.1): home
secret unreadable (tmpfs /home), sibling session unreadable
(session-only bind), network blocked (--unshare-net), 400-process
spawn storm capped by ulimit -u 256 (fork: retry), 60s sleep killed at
3s timeout, orphans die with the namespace; session-dir write visible
on host; direct backend regression (exit=7 / exit=timeout texts)
unchanged.
Impact: run_shell/run_python route through the backend; workflow
ScriptCommand and the squad kernel ExecConfig stay direct (follow-up
scope); config key execBackend + env AGENT_SYSTEM_EXEC_BACKEND + CLI
--exec-backend; extension.Options.ExecBackend (SurfaceVersion
2.6.0-experimental); DisableExecTools remains the top-priority
fail-closed switch.
Refs: proposal 2026-10-09-ext-g1-b1-b3-exec-backend.md section 4
(EXT-16, G2-8 prototype); Backend #110 (DisableExecTools).
weichen
merged commit 1a550895c3 into main2026-10-09 17:02:57 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why: Q2 ruled exec tools stay disabled for now but code execution must return later; the recovery path treats model-generated code as untrusted. This abstracts the interpreter launch point (exec_interpreter.go runInterpreter) into an ExecBackend port: direct = byte-identical status quo, sandbox = bwrap isolation (ro system root, tmpfs over /home and /tmp, session-dir and skills-dir only mounts, --unshare-all no network, ulimit -u 256 fork cap, timeout kills the whole namespace).
Evidence: go test ./... 32/32 green; local escape negatives (bwrap 0.11.1, skip-guarded in CI): home secret unreadable, sibling session unreadable, network blocked, 400-process spawn storm capped (fork: retry), 60s sleep killed at 3s, orphans die with namespace; session-dir write visible on host; direct regression texts unchanged (exit=7 / exit=timeout). Full log in the task card evidence rows.
Impact: config execBackend key + AGENT_SYSTEM_EXEC_BACKEND + --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental); link pass-through; app.Run validates fail-closed. run_shell/run_python only — workflow ScriptCommand and squad ExecConfig stay direct (follow-up). DisableExecTools stays top priority.
Refs: proposal 2026-10-09-ext-g1-b1-b3-exec-backend.md §4 (EXT-16, G2-8 prototype); Backend #110.