Blomios
28bb706c61
Cause: the workspace.execTool sandbox only granted the project root plus read-only system roots, so CLI tools like git failed when opening /dev/null with O_RDWR (redirect/exec 3<>/dev/null) inside sandboxed runs. Fix: workspace_exec_sandbox pushes one precise /dev/null PathGrant with RO|RW access; project read effect stays RO|EXEC and no blanket /dev grant is added, so the widening is limited to the null device; GitPlugin untouched. Tests: application asserts the read sandbox keeps project RO|EXEC while granting /dev/null RO|RW (workspace_exec_read_sandbox_grants_dev_null_without_widening_project_access); infrastructure proves the local runner executes exec 3<>/dev/null (local_runner_allows_cli_to_open_dev_null_for_read_and_write). QA verte reconfirmée par Git: cargo test -p application workspace_exec 5/5, -p infrastructure local_runner_allows_cli_to_open_dev_null 1/1, -p infrastructure workspace_tool::tests 5/5, cargo fmt --all --check, git diff --check. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The file is empty.