fix(sandbox): scrub sensitive credentials from sandbox environment#660

Merged

kevincodex1 merged 12 commits into

Gitlawb:mainfrom

euxaristia:fix/sandbox-credential-leakage

Jul 14, 2026

Commits on Jul 13, 2026

fix(windows): retry atomic file renames on Access is denied / Sharing violation
euxaristia
committed
test(swarm): add unit tests for rename retry and non-retryable errors
euxaristia
committed
test(swarm): skip TestMailboxRenameRetry on non-Windows platforms
euxaristia
committed
fix(sandbox): scrub sensitive provider credentials from sandbox env
euxaristia
committed
refactor(sandbox): unify environment creation and reduce lines of code
euxaristia
committed
fix(sandbox): forward workspaceRoot through sandboxEnvironment, gate Windows env on backend
euxaristia
committed
style(sandbox,swarm): remove stray blank lines flagged by gofmt
euxaristia
committed
refactor(fsutil): extract shared rename retry helper, derive scrub list from provider catalog
euxaristia
committed
fix(sandbox): deny sandboxed reads of cloud credential stores by default
euxaristia
committed
test(cli): pin HOME in sandbox policy golden test
euxaristia
committed
fix(sandbox): protect GOOGLE_APPLICATION_CREDENTIALS without a home, retry lock violations
euxaristia
committed

Commits on Jul 14, 2026

fix(sandbox): tighten env-scrub test assertion and add missing secret keys
euxaristia
committed