fix: sandbox path mounting and workspace isolation (#129, #136)#137

Open

Erudition wants to merge 21 commits intonextlevelbuilder:mainfrom

Erudition:fix-issue-129-sandbox-workspace-path

Commits on Mar 11, 2026

fix(sandbox): use configured GOCLAW_SANDBOX_WORKSPACE_PATH instead of hardcoded '/workspace'
Erudition
committed
fix(config): allow setting sandbox Workdir via GOCLAW_SANDBOX_WORKSPACE_PATH
Erudition
committed
fix(sandbox): resolve host mount dynamically for DooD volumes
Erudition
committed
fix(agent): correctly resolve default workspace relative to global workspace
Erudition
committed
fix(agent): remove unused fmt import breaking build
Erudition
committed
fix(sandbox): prevent docker exec path escapes for out-of-bounds agent workspaces causing OCI runtime crashes
Erudition
committed
fix(ui): use variable proxy_pass in nginx with docker resolver to prevent permanent DNS caching
Erudition
committed
fix(agent): migrate legacy ~/.goclaw/ workspace paths to GlobalWorkspace in internal resolver
Erudition
committed
fix(agent): handle absolute paths in legacy workspace migration
Erudition
committed
fix(agent): migrate legacy user profile workspaces to global workspace
Erudition
committed
fix(agent): ensure every agent has a persisted default workspace
Erudition
committed
Fix Sandbox Isolation Breach: map host paths to container paths in filesystem tools
Erudition
committed
Fix Sandbox Isolation Breach: map host paths to container paths in filesystem tools
Erudition
committed
Fix build failure: remove unused path/filepath import in shell.go
Erudition
committed
feat: add networking utilities and passwordless sudo to sandbox
Erudition
committed
feat: propagate sandbox network status and relax security policy for DNS tools
Erudition
committed
feat: improve sandbox networking and add security policy tests
Erudition
committed
feat: auto-build sandbox image via compose
Erudition
committed
fix: propagate per-agent NetworkEnabled to Docker container creation
Erudition
committed
feat(ui): support space-separated and quoted arguments in MCP server form
Erudition
committed
fix: clean up outdated context keys
Erudition
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: sandbox path mounting and workspace isolation (#129, #136)#137

fix: sandbox path mounting and workspace isolation (#129, #136)#137
Erudition wants to merge 21 commits intonextlevelbuilder:mainfrom
Erudition:fix-issue-129-sandbox-workspace-path

Commits on Mar 11, 2026

fix(sandbox): use configured GOCLAW_SANDBOX_WORKSPACE_PATH instead of hardcoded '/workspace'

fix(config): allow setting sandbox Workdir via GOCLAW_SANDBOX_WORKSPACE_PATH

fix(sandbox): resolve host mount dynamically for DooD volumes

fix(agent): correctly resolve default workspace relative to global workspace

fix(agent): remove unused fmt import breaking build

fix(sandbox): prevent docker exec path escapes for out-of-bounds agent workspaces causing OCI runtime crashes

fix(ui): use variable proxy_pass in nginx with docker resolver to prevent permanent DNS caching

fix(agent): migrate legacy ~/.goclaw/ workspace paths to GlobalWorkspace in internal resolver

fix(agent): handle absolute paths in legacy workspace migration

fix(agent): migrate legacy user profile workspaces to global workspace

fix(agent): ensure every agent has a persisted default workspace

Fix Sandbox Isolation Breach: map host paths to container paths in filesystem tools

Fix Sandbox Isolation Breach: map host paths to container paths in filesystem tools

Fix build failure: remove unused path/filepath import in shell.go

feat: add networking utilities and passwordless sudo to sandbox

feat: propagate sandbox network status and relax security policy for DNS tools

feat: improve sandbox networking and add security policy tests

feat: auto-build sandbox image via compose

fix: propagate per-agent NetworkEnabled to Docker container creation

feat(ui): support space-separated and quoted arguments in MCP server form

fix: clean up outdated context keys