firat.sertgoz f88ef87cef feat(sandbox): manifest-declared direct-exec credential bindings behind the managed proxy (#7810) ...

* feat(sandbox): mediate GitHub CLI credentials

* refactor(sandbox): genericize staged process credentials

* refactor(sandbox): replace GitHub credential carve-out with manifest-declared bindings (#7825)

* fix(sandbox): address PR #7810 review findings

- share one quote-aware single_direct_argv predicate between kernel
  authorization enrichment and shell dispatch (host_api::process); reject
  path-form executables; single-quote backslashes stay literal; defined
  double-quote escape set
- constrain credential authority to active-extension declarations with
  deterministic collision rejection (no registry-wide first-wins)
- GitHub binding uses the CLI's real 'token ' authorization scheme
- delegate supports_credentialed_direct_command to the wrapped transport
  (Railway no longer advertises unsupported direct-exec)
- cancellation/panic-safe credential cleanup guard; teardown deletes
  material even when proxy reload fails; reject empty placeholders and
  header names before rendering replace rules
- keep secret material zeroized through bundle composition and atomic
  writes; ironclaw-exec emits outcome markers on spawn failure (126/127)
- cause-preserving staging errors; case-normalized credential comparison
  fields; fail-closed binding-validation and enrichment-authority tests
- re-capture host_api size ceiling (20_579 -> 20_728) for the shared
  parser move

* fix(ci): align GitHub auth scheme expectations

* fix(sandbox): preserve authorized credential descriptors

* fix(sandbox): keep Docker bind mounts stable

* fix(sandbox): authorize generic shell credential contexts

* fix(host-runtime): guide authenticated shell contexts

* fix(sandbox): stabilize authenticated shell reuse

* fix(ci): repair credential surface contracts

* fix(host-runtime): scope credential contexts to sandbox profiles

* test(credentials): assert declared GitHub auth prefix

* test(host-api): consolidate authorized witness seam

* test(composition): include empty shell credential contexts

* fix(review): tighten sandbox credential authority

* fix: stabilize IronHub runtime assembly test

* fix: grant shell manifest credentials

* test: cover shell credential grants through factory

* test: align GitHub credential header assertion

2026-08-26 23:18:37 +00:00

..

ironclaw-exec

…

ironclaw-sandbox-idle

…