feat: sandbox local member execution on Linux and macOS

[Soulter]

Summary

• allow non-admin Local shell and Python execution when computer_use_require_admin is disabled on Linux and macOS
• isolate Linux calls with bubblewrap and macOS calls with Seatbelt (sandbox-exec), both using fail-closed policies
• expose only the session workspace as writable, clear the inherited environment, block network access, and apply process, CPU, file, descriptor, wall-time, and output limits
• explicitly block macOS URL/application broker paths such as open, osascript, Apple Events, and LaunchServices lookups
• preserve existing unsandboxed behavior for admins and existing behavior for remote Sandbox runtimes; unsupported Local platforms still deny non-admin execution
• keep non-admin Local file tools workspace-restricted even when the admin requirement is disabled

Runtime behavior

Linux requires bwrap and functional unprivileged user namespaces. macOS requires /usr/bin/sandbox-exec. Missing or unusable platform support fails closed and never falls back to direct host execution.

Apple marks sandbox-exec as deprecated, so this path is intentionally isolated behind the Local non-admin boundary and guarded by integration coverage. macOS cannot safely lower RLIMIT_AS after the Python launcher has started, so the 1 GiB address-space limit remains Linux-only; the other resource, time, and output limits apply on both platforms.

Validation

• uv run ruff format .
• uv run ruff check .
• uv run pytest -q tests — 1963 passed
• Linux bubblewrap smoke test — workspace read/write succeeded, paths outside the workspace were hidden, and network access was blocked
• macOS Seatbelt integration test — workspace read/write succeeded; external file reads, host-process access, inherited host environment, URL brokering, and network access were blocked
• Microsoft Edge network-isolation smoke test — a data: page rendered successfully under a test-only IP-denied Seatbelt profile, while https://example.com produced the browser network error page; Edge Updater requests also failed with no network route

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	astrbot-docs	56767f3	Commit Preview URL Branch Preview URL	Jul 30 2026, 04:48 PM