didericis b765f87fb5 test(smolmachines): verify Linux sandbox escape gate + fix platform check ...

Empirical verification on NixOS/Linux with /dev/kvm + smolvm 1.4.7:

  1. DB path confirmed: ~/.local/share/smolvm/server/smolvm.db exists,
     schema matches (vms table, data BLOB with allowed_cidrs JSON field).

  2. smolvm 1.4.7 still silently drops --allow-cidr with --from
     (allowed_cidrs=None in DB after create). force_allowlist patch
     is still necessary and correct.

  3. All 5 sandbox-escape attacks blocked with BOT_BOTTLE_BACKEND=smolmachines
     on Linux: hostname/IP allowlist, HTTP DLP, DNS exfil, git-gate gitleaks.

Changes:
- test_sandbox_escape: remove darwin-only guard; allow linux too
- contrib/claude/Dockerfile: add dnsutils (dig) for attack 4 DNS test

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-07-09 00:54:50 -04:00

..

claude

test(smolmachines): verify Linux sandbox escape gate + fix platform check

2026-07-09 00:54:50 -04:00

codex

fix: repair codex resume paths

2026-07-08 12:38:15 -04:00

gitea

fix: add explicit timeouts to subprocess and HTTP calls in git-gate paths

2026-06-25 04:12:43 -04:00

pi

feat(cli): add headless launch mode for orchestrators

2026-06-30 15:08:14 -04:00

__init__.py

feat(prd-0048): implement SSH deploy-key provisioning with contrib/gitea

2026-06-03 11:58:36 -04:00