Issues

• The broker resumes a caller before closing its copy of the opened file, so a just-written script fails exec with ETXTBSY

  area:sandboxbug
  May-Agent/heel#226 · Filter by author lexoliu opened on Nov 12, 2026

• Linux: an orphaned sandboxed process loses brokered file access under ptrace_scope 1

  area:sandboxbug
  May-Agent/heel#223 · Filter by author lexoliu opened on Nov 11, 2026

• IPC connections block pool threads without deadlines or a connection cap

  area:ipcbug
  May-Agent/heel#158 · Filter by author lexoliu opened on Nov 2, 2026

• Node binding: waitWithOutput drains stdout and stderr sequentially

  area:sandboxbug
  May-Agent/heel#157 · Filter by author lexoliu opened on Nov 2, 2026

• Windows ignores CPU-time, process-count and file-size limits

  area:sandboxbug
  May-Agent/heel#156 · Filter by author lexoliu opened on Nov 2, 2026

• Unix execute() leaves processes outside cleanup tracking

  area:sandboxbug
  May-Agent/heel#155 · Filter by author lexoliu opened on Nov 2, 2026

• Proxy host-local check misses the host's own interface addresses

  area:sandboxbug
  May-Agent/heel#154 · Filter by author lexoliu opened on Nov 2, 2026

• Linux: metadata changes are not confined to writable grants

  area:sandboxbug
  May-Agent/heel#153 · Filter by author lexoliu opened on Nov 2, 2026

• Windows: proxied sandboxes can connect directly, bypassing the network policy

  area:sandboxbug
  May-Agent/heel#152 · Filter by author lexoliu opened on Nov 2, 2026

• Linux: READ and WRITE grants also allow execute

  area:sandboxbug
  May-Agent/heel#151 · Filter by author lexoliu opened on Nov 2, 2026

• Linux: O_RDONLY|O_CREAT opens bypass the read denylist

  area:sandboxbug
  May-Agent/heel#150 · Filter by author lexoliu opened on Nov 2, 2026

• Linux: credential protections win over an enclosing grant

  area:sandboxbug
  May-Agent/heel#139 · Filter by author lexoliu opened on Oct 30, 2026

• Measure the per-open cost of the Linux read broker

  area:sandboxenhancement
  May-Agent/heel#138 · Filter by author lexoliu opened on Oct 30, 2026

• A sandboxed process on Windows cannot list or enter a granted directory

  area:sandboxbug
  May-Agent/heel#131 · Filter by author lexoliu opened on Oct 29, 2026
  1

• The first proxied launch to finish removes the loopback exemption its siblings still use on Windows

  area:sandboxbug
  May-Agent/heel#123 · Filter by author lexoliu opened on Oct 29, 2026

• Enforce the credential and persistence denylists on Windows

  area:sandboxenhancement
  May-Agent/heel#116 · Filter by author lexoliu opened on Oct 29, 2026

• Sandboxed processes can signal any process of the user

  bug
  May-Agent/heel#105 · Filter by author lexoliu opened on Oct 28, 2026
  3

• CONNECT tunnel loses the bytes a pipelining client sends before the 200, and the client reports it as a certificate error

  May-Agent/heel#24 · Filter by author lexoliu opened on Sep 2, 2026

• Outdated dependencies

  dependencies
  May-Agent/heel#14 · Filter by author github-actions opened on Aug 31, 2026

• macOS: network-enabled sandboxes hang with Sandbox::with_config(...) and heel run --network allow because the default executor path does not drive the proxy

  May-Agent/heel#10 · Filter by author tonyzhoup opened on Apr 27, 2026