Windows-native MCP agent sandbox for Ollama with LPAC, NTFS ACL, Job Objects, and WFP. https://git.takashi-2521.com/winagent-sandbox-mcp.git/atom?h=main 2026-08-11T20:44:54+00:00 2026-08-11T20:44:54+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T20:44:54+00:00 urn:sha1:b56614c814b904c224315a11f9686f0d47abd3d3 Rewrite the specification and design vocabulary around User Sandbox Configuration, Environment Resolution, Executable Approval, Effective Sandbox Policy, and Windows Enforcement. Move the Internal Tool catalog to the design without treating its count as a requirement, and update README, implementation planning, traceability, audit history, prompts, and the Python skill. Introduce schema_version 1 profiles, workspaces, mounts, executable aliases, network modes, and resource presets. Add local override merging, resolution and approval stores with atomic user-only persistence, fail-closed fingerprints, localized diagnostics, and executable/sandbox management CLI commands. Change Windows execution to LPAC entry approval with inherited descendant confinement. Separate read and execute ACLs, preserve protected OS DACLs, apply Job process/memory/timeout limits to the tree, enforce WFP network modes, prevent credential environment inheritance, disable out-of-tree MSBuild reuse, and harden transactional ACL/recovery cleanup. Isolate planning prompts from execution instructions, reject split coding plans that cannot satisfy task-scoped evidence, preserve configured thinking, and prevent optional task_update failures from corrupting completion checks. Add and update configuration, resolution, approval, LPAC, descendant, readonly/development, Registry/COM, WFP, recovery, .NET/Python/PowerShell process-tree, and Operational E2E coverage. Publish reproducible bundles while preserving deployment-local configuration, prompts, skills, logs, state, approvals, and resolutions. 2026-08-11T15:21:23+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T15:21:23+00:00 urn:sha1:98b6a2aeedd591058c1d81e401d24f3ded162926 Model Ollama chat thinking separately from final content, preserve it only across assistant tool-call continuation, and keep private reasoning out of user results, session context, and logs. Accept native boolean and low/medium/high/max think values, normalize YAML booleans, and serialize explicit overrides using the native top-level chat field. Stop forcing think=false for structured planning, skill selection, and context summaries; corrected retries now retain the configured thinking mode. Update the specification, design, audit report, and requirement traceability for OLL-14. Add request/response, configuration, observability, retry, and tool-continuation coverage. Verified with 92 passing Agent.Core tests and a deepseek-v4-flash:cloud think:true MCP operational run. 2026-08-11T15:02:23+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T15:02:23+00:00 urn:sha1:ce550a127b7dc972651bd15b9f09979a2c38688f Replace the uv-specific skill with a portable Python skill and rewrite the default user system prompt as a concise, structured Markdown execution policy. Normalize a single fenced structured-JSON response, retry invalid skill selection with think disabled, validate selected skill output, and make coding plans keep editing and verification in one task. Document the file_edit patch payload, expose that contract in the tool catalog, and convert malformed patch input into a retryable tool failure instead of terminating the agent task. Update configuration and runtime tests for the Python skill, exact tool catalog, structured-output retry, and implementation-and-verification planning guidance. Verified with 82 Agent.Core tests and an agent-mcp Python scheduling scenario with 49 passing unittest cases. 2026-08-11T13:40:46+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T13:40:46+00:00 urn:sha1:37386b89b6272f4cef34ab3bf131f11ed3afa13f 2026-08-11T13:36:21+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T13:36:21+00:00 urn:sha1:8f8e82e00e5d0e9347feef10111faac788ad7d88 2026-08-11T13:20:25+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T13:20:25+00:00 urn:sha1:842e55654db060c84448f3a0deddb24f77fad5a7 2026-08-11T13:04:42+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T13:04:42+00:00 urn:sha1:66701c56acb06c9cb56601f5deb65235f5178071 2026-08-11T12:53:57+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T12:53:57+00:00 urn:sha1:7c9794f8d4d05074b96bb525d19db4ee1f6b3e95 2026-08-11T12:44:53+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T12:44:53+00:00 urn:sha1:6c3458a5ec37a5b69957ad17c84de58984698f25 2026-08-11T04:51:59+00:00 tanaka takashi isazaka@gmail.com 2026-08-11T04:51:59+00:00 urn:sha1:b5ccecca01007f2a2459265df6d749fbfd31aa84 AgentRuntime.ExecutePlannerTaskAsync: - Add PlannerValidationException and FileNotFoundException to the tool execution catch clause so that 'Completed tasks are immutable' and 'Approved path does not exist' errors are returned as tool results instead of propagating as unhandled task failures. - Treat task_update as a metadata tool: its failures no longer add to unresolvedToolFailures, so the LLM is not forced into an infinite retry loop when task_update receives invalid arguments. - Skip throwing InvalidOperationException for RetryAllowed=false failures originating from metadata tools (task_update), preventing unnecessary replan cycles caused by graph bookkeeping errors. - Improve the 'No tasks were executed' fallback message: when replan was attempted but no tasks could execute, report that the sandbox policy denied required operations. PlannerService.PlanAsync: - Persist fallback TaskGraph to session.TaskGraphs[taskId] in all three fallback paths (ChatStructuredAsync exception, empty/null plan, BuildTaskGraph exception) so that BeginTask's TryAdd does not create an empty graph that shadows the fallback.