Harden sandbox networking and installer

[abhishek-anand]

Summary

• pin Apple container 1.2.2 and update the 1.x DNS configuration path
• add a host-only network mode with fail-closed resume checks
• bind Jupyter and Playwright to loopback and validate REST Host/Origin headers
• block skill path traversal and unsafe ZIP extraction
• install the Claude Desktop proxy in a pinned virtualenv and add readiness checks

Testing

• default network: 10 end-to-end checks passed
• host-only network: 11 end-to-end checks passed, including root container exec egress denial
• installer default/offline resume paths and network-mode mismatch behavior verified on macOS 26.5.1 with Apple container 1.2.2

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[Copilot]

Pull request overview

This PR hardens the CodeRunner sandbox by tightening network exposure, adding Host/Origin validation for REST routes, and improving installer behavior for offline/host-only operation while pinning key dependencies.

Changes:

• Add a host-only/offline network mode in the installer with resume-time network-mode checks and readiness probing via a new /health endpoint.
• Bind internal services (Jupyter, Playwright) to loopback and add Host/Origin allowlisting middleware for non-MCP REST routes.
• Harden skill handling by blocking path traversal and adding ZIP extraction safety checks; pin fastmcp in examples and the proxy venv.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
test-e2e.sh	Adds E2E smoke tests covering new security/network behaviors and skill traversal protections.
server.py	Adds extra allowed hostnames, skill ZIP/path traversal hardening, /health, and REST Host/Origin validation middleware.
README.md	Documents offline/host-only network mode and clarifies proxy venv usage.
install.sh	Pins Apple container to 1.2.2, updates DNS config path behavior, adds network-mode logic and readiness checks, and creates a pinned proxy venv.
examples/requirements.txt	Pins fastmcp version for reproducibility.
examples/claude_desktop/mcpproxy.py	Improves failure messaging and exits when DNS resolution fails.
entrypoint.sh	Restricts Jupyter/Playwright to loopback and removes permissive Jupyter settings.
docker-compose.yml	Updates healthcheck to use the new /health endpoint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mkagenius]

Tested on my mac via copilot .. set -u is not supported i guess, fixed it.