mweinbach6/9/2026, 11:08:22 PM

- loadSkillBody: defang an embedded `[END/BEGIN UNTRUSTED PROJECT SKILL]`
  marker in a project skill body and strip frame-breaking chars from the
  interpolated name, so a malicious workspace SKILL.md cannot close the
  untrusted frame early and place text outside it (same class as the
  webFetch end-marker fix).
- google-native: gate Gemini's provider-native web tools (google_search/
  url_context) on the sandbox network policy. Previously a no-network
  sandbox only disabled the local webFetch execute path while webFetch
  stayed advertised, which still enabled provider-side web requests. Thread
  networkAllowed (reusing the already-resolved sandbox policy) into the
  Google runtime and suppress nativeWebSearch when network is blocked.

Adds regression tests for both.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Parentd60786a