Runtime guard (sitecustomize):
- Keep the network guard active when a sandbox child deletes
UNSLOTH_STUDIO_SANDBOXED but still loads this shim from the sandbox_site dir
on PYTHONPATH. Bypass runs under bypass_site (guard short-circuits on
__name__), so an absent flag with sandbox_site loaded is tampering, not
bypass. Regression test spawns a real deleted-flag child.
Terminal startup-guard (hard block in _bash_exec):
- A here-doc piped into a consumer (cat <<'PY' | python) keeps the post-delimiter
pipeline so the body is scanned as that python's stdin program.
- Process substitution: recurse into <(...)/>(...) inner commands, and fail
closed when python reads its program from one (python <(printf ...)).
render_html network gate (auto-approve path):
- Module re-exports (export * from 'https://...', export {a} from '/mod.js')
are gated like static imports; relative specifiers stay static.
- A reassigned computed-key alias (var k='src'; img[k]=URL; var k='title') is
position-dependent, so it is dropped from the flat alias map and fails closed
on a network-looking assigned value.
Adds blocked + safe regression cases for each.
Not addressed: the spoofed-trusted-httpx-frame P1 (exec(compile(payload,
httpx.__file__,'exec'), httpx.__dict__)). Same same-interpreter forgeability
class already flagged for a below-the-Python-layer redesign; a frame check
keyed on caller-suppliable co_filename cannot close it robustly.
fa4693685f