- managed LibreOffice: verify repo-pinned SHA-256 before extract/promote/exec and require a checksum for custom download URLs (CWE-494)
- research uploads: constrain attachment IDs to generated UUIDs and validate pending-upload metadata path containment before copy/upload (CWE-22/CWE-200)
- Windows sandbox: require explicit unsandboxed approval for workspace-write/no-network commands under the non-enforcing helper instead of running them silently (CWE-284/CWE-693)
- workspace MCP: do not auto-start a workspace's own stdio MCP servers unless the workspace is explicitly trusted via env/user config (CWE-78/CWE-284)
Adds regression tests for each and updates sandbox/MCP/protocol docs.
Co-authored-by: Cursor <cursoragent@cursor.com>
