AIKIDO-2026-99876

TL;DR

The sandbox routes restricted processes through loopback HTTP and SOCKS proxies that listen on 127.0.0.1 and enforce the configured network policy. These proxies require no authentication, so any local process can dial them and reach the proxy and its filter callback, undermining the intended per-session network isolation. The fix requires a per-session token (Basic auth for HTTP and SOCKS5 user/password for SOCKS) that is generated at init and exported only into the sandboxed child process environment. It also lets deniedDomains accept a bare "*" as a deny-all rule and adds a strictAllowlist mode that blocks off-allowlist hosts without falling back to the ask callback.