feat(filesystem): add bind-mount deny lists to hide host files/paths - #1448

Open

neurolabs wants to merge 46 commits into

superradcompany:mainfrom

neurolabs:bind-mount-deny-option

Commits on Aug 21, 2026

feat(filesystem): add shared DenyList matcher for bind mounts
neurolabs
committed
514559d
feat(filesystem): enforce deny list in unix passthrough backend
neurolabs
committed
f166463
feat(filesystem): enforce deny list in windows passthrough backend
neurolabs
committed
b0d26cc
refactor(filesystem): move deny matcher to the backends level
neurolabs
committed
89cdef2
refactor(filesystem): move deny matcher to passthroughfs level
neurolabs
committed
28ad41f
test(filesystem): add windows deny-list tests
neurolabs
committed
1247bec
feat(runtime): parse deny mount option and wire into passthrough config
neurolabs
committed
75fe480
feat(sdk): add deny list to bind mount builder
neurolabs
committed
99c48f0
feat(cli): add deny mount option to --mount-dir
neurolabs
committed
e7f5225
feat(sdk/go): add deny list to bind mount options
neurolabs
committed
90ae2e7
docs: document bind-mount deny list option
neurolabs
committed
2970f5b
fix(filesystem): drop needless borrow in deny path match
neurolabs
committed
f945391
fix(filesystem): never deny structural . and .. entries
neurolabs
committed
0efcf1b
fix(sdk): reject deny patterns that break the mount wire format
neurolabs
committed
b6b145c
fix(sdk/go): reject deny on non-bind mounts
neurolabs
committed
13c09e7
fix(sdk): reject bind-mount deny lists on cloud creates
neurolabs
committed
a517c52
feat(cli): show deny list in sandbox inspect output
neurolabs
committed
7129f98
refactor(filesystem): tidy deny.rs section ordering
neurolabs
committed
f08d1de
feat(filesystem): add macOS F_GETPATH path-resolution helpers
neurolabs
committed
7f6af3e
feat(filesystem): store canonical mount root on macOS
neurolabs
committed
be4a35e
feat(filesystem): resolve macOS parent paths via /.vol and F_GETPATH
neurolabs
committed
da53f58
fix(filesystem): fail closed on unresolvable parent path under deny patterns
neurolabs
committed
0f992b5
test(filesystem): gate macOS path-pattern deny resolution tests
neurolabs
committed
351e0cd
docs(filesystem): document macOS path-pattern deny enforcement
neurolabs
committed
b4c5d28
fix(filesystem): Implement fixes for deny lists
neurolabs
committed
19e9087
refactor(filesystem): rework deny case probe and dirent-type helpers
neurolabs
committed
6e97172
refactor(filesystem): split deny has_path_patterns into routing and dir-only flags
neurolabs
committed
81b7c35
test(filesystem): pin deny flag-split routing semantics
neurolabs
committed
acfabd7
docs(filesystem): fix dir-only gate comment and rename deny test
neurolabs
committed
e558a00
refactor(filesystem): human review fixes
neurolabs
committed
cd7ed40
feat(sdk): add bind-mount deny list to Python and Node SDKs
neurolabs
committed
deb9a10
chore: inspect deny-rendering test
neurolabs
committed
2d7dbf1

Commits on Aug 23, 2026

Commits on Aug 24, 2026

Commits on Aug 25, 2026

Merge remote-tracking branch 'origin/main' into bind-mount-deny-option
neurolabs
committed
d8aad9b

Commits on Aug 26, 2026

Merge branch 'main' into bind-mount-deny-option
neurolabs
authored
83dac92
Merge branch 'main' into bind-mount-deny-option
neurolabs
authored
ef01559

Commits on Sep 1, 2026

Merge branch 'main' into bind-mount-deny-option
neurolabs
authored
62c6b05

Commits on Sep 2, 2026

Merge branch 'main' into bind-mount-deny-option
neurolabs
authored
9ad13e4