fix(local-sandbox): allow SRT proxy sockets on Linux

[sirmace72]

Fixes #482

Summary

Allow the Linux local sandbox to read the SRT HTTP/SOCKS Unix socket paths without exposing unrelated host paths.

This fixes sandboxed network access that could fail when denyRead: ['/'] hid the SRT proxy bridge sockets.

Changes

• add exact Linux SRT HTTP/SOCKS socket paths to the local sandbox read allowlist
• keep unrelated host /tmp paths hidden
• strengthen host-home secret read protection coverage
• add a Linux smoke regression test for SRT socket visibility

Validation

• pnpm smoke:local-sandbox
• pnpm --filter @truefoundry/trueforge typecheck
• pnpm --filter @truefoundry/trueforge test:local-sandbox:contract

All passed.

---

Note

Medium Risk
Narrows the sandbox filesystem read policy for Linux; regression tests assert SRT sockets stay reachable while unrelated host /tmp and home secrets remain blocked.

Overview
Fixes Linux local sandbox HTTPS/pip-style network failures when broad denyRead: ['/'] blocked the SRT HTTP/SOCKS bridge Unix sockets under host /tmp.

hostRun.ts now adds a Linux-only read allowlist for the exact paths from SandboxManager.getLinuxHttpSocketPath() and getLinuxSocksSocketPath(), merged into filesystemPolicy alongside the existing sandbox root and Code Mode socket parent entries—without opening all of host /tmp.

Smoke coverage adds smokeLinuxSrtProxySocketReadGate (stat the HTTP bridge socket, assert an unrelated /tmp sentinel stays invisible) and tightens host-home isolation by probing a secret file under $HOME instead of only listing $HOME. Lima provisioning installs python3-venv for the guest smoke environment.

^{Reviewed by Cursor Bugbot for commit 5f24fb3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 5f24fb3

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chiragjn]

Thank you for raising this fix, we will do some testing and get this in