weichen
4badecbf57
ci / vet-and-test (pull_request) Successful in 41s
Why: Q2 ruled exec tools stay disabled for now but code execution must return later; the recovery path treats model-generated code as untrusted. This abstracts the interpreter launch point in exec_interpreter.go into an ExecBackend port (direct = byte-identical status quo; sandbox = bwrap isolation) so downstream products can re-enable execution behind isolation without further base surgery. Evidence: go build/vet clean; go test ./... 32/32 packages green; sandbox escape negatives all blocked locally (bwrap 0.11.1): home secret unreadable (tmpfs /home), sibling session unreadable (session-only bind), network blocked (--unshare-net), 400-process spawn storm capped by ulimit -u 256 (fork: retry), 60s sleep killed at 3s timeout, orphans die with the namespace; session-dir write visible on host; direct backend regression (exit=7 / exit=timeout texts) unchanged. Impact: run_shell/run_python route through the backend; workflow ScriptCommand and the squad kernel ExecConfig stay direct (follow-up scope); config key execBackend + env AGENT_SYSTEM_EXEC_BACKEND + CLI --exec-backend; extension.Options.ExecBackend (SurfaceVersion 2.6.0-experimental); DisableExecTools remains the top-priority fail-closed switch. Refs: proposal 2026-10-09-ext-g1-b1-b3-exec-backend.md section 4 (EXT-16, G2-8 prototype); Backend #110 (DisableExecTools).