v1.5.2

v1.5.2

Opt-in Linux filesystem isolation for shell commands: sandbox.mode: isolated runs commands under a Landlock ruleset (read-write workspace and private temp directory, read-only system paths, /proc and $HOME denied) plus no_new_privs. Commands refuse to run where Landlock is unavailable. Shell and job children also no longer inherit the provider credential variables Forcefield itself reads. A new sandbox-probe CI job reports the Landlock ABI per runner and enforces boundary tests in required mode.

Changes

• Isolated execution mode (Linux only, opt-in via sandbox.mode: isolated): Landlock filesystem confinement with always-pinned working directory, per-execution private TMPDIR, credential stripping, and fail-closed setup; refuses to construct on Windows/macOS. Optional sandbox.isolated.read/write extras.
• Credential environment filtering: provider api_key_env names (plus legacy key) removed from shell/job child environments; explicit per-command env still applies.
• Sandbox boundary-test harness with FF_REQUIRE_BOUNDARY fail-closed gating, Landlock ABI probe reporting, spawn-site audit, and a three-OS sandbox-probe CI job with required-mode checks.

Limitations

• Isolated mode confines filesystem access only: host networking, process groups, and resource use are unchanged, and it is not malware containment.
• Shell writes to .git/hooks and similar paths inside the workspace are not blocked; macOS has no isolation backend.

Full Changelog: v1.5.1...v1.5.2