The demo no longer downgrades the PTY to a restricted shell — it refuses
/api/pty outright and simulates a terminal in the browser — so
internal/pty/restricted_pipeline.go had no callers left. Its 14-command
whitelist still shelled out via exec.CommandContext, which is exactly the
capability the demo is meant not to have.
Removed together with its test, since neither is meaningful without the
other. pty.Runner stays: it is still the return type of NewPipeLine.
Also ignore nginx-ui-linux-*/ — cloudflare/build-binary.sh drops a
120 MB cross-compiled binary there for demo.Dockerfile to copy. Only the
inner filename happened to match an existing rule, so the directory
itself was untracked but not ignored.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
392683a684