wg-wrap.git/Makefile, branch main

Fix DNS leaks, lifecycle race, and editor arg splitting

2026-05-29T23:56:45Z

- DNS Leak / Isolation Bypass: Blocked glibc's systemd-resolved and D-Bus socket communication within the unprivileged mount namespace by introducing BlockHostServices(). This targeted mount-blocking forces glibc to fall back to the standard resolv.conf DNS routing path and prevents host leaks. - Lifecycle Race: Reordered and protected the reference-counting cleanup routine under the profile flock to ensure that check-and-unpin operations are atomic and do not teardown namespaces actively used by parallel processes. - Editor Arguments: Split the EDITOR environment variable into discrete field tokens before invocation to support editor configurations containing command-line flags. - Testing: Added E2E regression tests for DNS leak detection, namespace unpinning concurrency, and editor argument parsing. All E2E tests now compile and pass cleanly.

refactor: optimize file cleanups, propagate exit codes, and fix Makefile

2026-05-29T23:21:49Z

- Unlink the temporary bootstrap launcher binary immediately after opening a read-only descriptor to it, then execute via `/proc/self/fd/` to ensure zero-disk footprint on execution. - Unlink temporary `/tmp/resolvconf*` files immediately after successful bind-mounting over `/etc/resolv.conf`. - Prune parent ephemeral profile directories when unpinning a namespace, leaving zero directories behind once empty. - Propagate the exact exit status of the wrapped command to the host process using `errors.As` and `*exec.ExitError` instead of defaulting to exit code 1. - Added E2E automated test `TestExitCodePropagation` to verify exit status delivery. - Added the `$(BINARY)` target to `.PHONY` in the Makefile to delegate dependency tracking to Go's compiler cache, ensuring modified Go files are rebuilt during `make test`.

Fix PID lifecycle race and improve CLI routing for diagnostic commands

2026-05-22T15:37:57Z

Refactor lifecycle to support XDG_RUNTIME_DIR and fix binary pathing in E2E tests

2026-05-22T15:20:24Z

Implement automatic namespace lifecycle cleanup with last-man-out reference counting

2026-05-22T15:12:21Z

Update Makefile and README to standardize build/test process and lauch fuzzer

2026-05-22T14:51:00Z

Security hardening: prevent shell injection and null-byte crashes, implement 8-bit clean argument fuzzing and portable E2E binary discovery

2026-05-22T14:46:02Z

feat: implement rootless network isolation bootstrap and C launcher

2026-05-22T14:05:38Z