🛡️ fix: Harden Sandbox Startup and Internal Transports

[lia-by-librechat]

Summary

• Refuse microVM startup if the host-side seccomp filter cannot install.
• Deny all six PI-futex commands, including private/realtime variants, while preserving ordinary wait/wake.
• Reject redirects on internal Axios and fetch requests so tokens, signed executions, and file bodies stay on the configured endpoint.
• Update vulnerable service dependencies without changing Express, BullMQ, or MinIO major versions. Raise Axios/Express/MinIO minimums and pin compatible qs/uuid fixes.
• Add redirect, startup, syscall-policy, and MinIO XML regression coverage plus a deployed-kernel patch-verification runbook.

Security scope

This addresses verified policy and dependency gaps. It is not a fix for the undisclosed October KVM zero-day. Host/guest kernel patches and production inventory still require operator verification.

Service audit retains two documented findings: development-only braces has no published fix; MinIO uses stream-json's JSON-lines parser, not the affected path filters. No incompatible transitive major override or audit suppression is added.

Verification

Focused tests, builds, native Kafel/BPF checks, and CI are recorded in the head comment. Both workspace npx tsc --noEmit checks currently fail with the same diagnostics as an unchanged main snapshot using the same dependencies.

[lia-by-librechat]

Head: 1cd6bd7df8af23cd3f06436c28cdbafdd8b0bd92

Carries fail-closed launcher seccomp, PI-futex denial, redirect rejection across internal Axios/fetch paths, dependency fixes, regression tests, and the patch-verification runbook.

Local check	Result
Launcher cargo test, Fedora 43 + libkrun	17 passed
API focused tests, Bun 1.3.14	58 passed
Service focused tests, Bun 1.3.14 and 1.4.2	235 passed on each runtime
Pinned NsJail Kafel parser + installed x86 BPF	24 PI-futex variants denied; ordinary wake allowed
ARM64 Kafel policy compile	Passed, not executed on ARM
API and service builds	Passed
npx tsc --noEmit, API and service	8 API and 7 service diagnostics, identical to unchanged main using the same dependencies
Touched service ESLint	531 existing errors; no added errors versus main
Service lockfile audit	Two documented residual findings; no audit suppression
git diff --check; smoke-script bash -n	Passed

Not run: live KVM guest boot, full sandbox endpoint smoke, production kernel/package inventory, deployment. No protection claim for the undisclosed KVM zero-day.

Independent review

Reviewed head: 1cd6bd7df8af23cd3f06436c28cdbafdd8b0bd92. Complete, no findings at any severity. No fixes or rejections required. Review covered frozen-head source and CI, not deployed kernel patch status or live KVM boot.

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T15:43:30.105866Z	1cd6bd7	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 1cd6bd7df8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".