kward 0.78.0 → 0.79.0

data/lib/kward/prompt_interface.rb

@@ -364,6 +364,24 @@ module Kward
       run_editor
     end
 
+    # Opens an in-memory document editor. The callback receives edited content
+    # when the user saves; return an error message to keep the editor open.
+    def review_document(title:, content:, &on_save)
+      raise ArgumentError, "review_document requires a save callback" unless on_save
+
+      start(render: false)
+      opened = @mutex.synchronize do
+        @editor_save_callback = on_save
+        open_scratchpad(:markdown, content: content).tap do
+          @editor_state.status = "#{title} · Ctrl+S save · Ctrl+Q cancel"
+          render_prompt_locked
+        end
+      end
+      return false unless opened
+
+      run_editor
+    end
+
     def run_editor
       loop do
         key = read_key(nonblock: true)

data/lib/kward/prompts/commands.rb

@@ -33,7 +33,9 @@ module Kward
       { name: "tab", description: "Manage tabs.", argument_hint: "[1-n|move|close|new|name]" },
       { name: "status", description: "Show the current status message.", argument_hint: "" },
       { name: "stats", description: "Show telemetry logging stats.", argument_hint: "[range]" },
+      { name: "sandbox", description: "Inspect or configure model command sandboxing.", argument_hint: "[status|off|read_only|workspace_write|network allow|network deny]" },
       { name: "hooks", description: "Inspect lifecycle hooks.", argument_hint: "[list|events|logs|doctor|trust|untrust]" },
+      { name: "skill", description: "Activate a skill or capture one from a saved session.", argument_hint: "<name>|capture" },
       { name: "memory", description: "Inspect and manage Kward memory.", argument_hint: "[enable|disable|auto-summary|core|add|list|forget|promote|relax|inspect|why|summarize]" }
     ].freeze
     BUILTIN_RESERVED_COMMAND_NAMES = BUILTIN_COMMANDS.map { |command| command[:name] }.freeze

data/lib/kward/prompts.rb

@@ -38,6 +38,8 @@ module Kward
     # @return [Array<Hash>] section hashes with label, content, and optional source
     # @api public
     def prompt_sections(workspace_root: Dir.pwd, include_workspace_personality: true, model: nil, reasoning_effort: nil, now: Time.now, memory_context: nil, plugin_context: nil)
+      return replacement_prompt_sections if ConfigFiles.replacement_system_prompt?
+
       sections = [prompt_section("Built-in system prompt", base_prompt)]
       sections << prompt_section(config_agents_prompt_label, config_agents_prompt, source: config_agents_prompt_source)
       sections << prompt_section("Memory context", memory_context) unless memory_context.to_s.empty?
@@ -53,11 +55,11 @@ module Kward
 
     def base_prompt
       <<~PROMPT.strip
-        You are Kward, a concise practical CLI coding agent. Use tools to understand and modify software projects. Inspect files before changing them, make the smallest correct change, preserve existing style, and summarize what changed. Be honest about limitations.
+        You are Kward, a concise practical CLI coding agent. Use tools to understand and modify software projects. Only call tools advertised for the current turn. Inspect files before changing them, make the smallest correct change, preserve existing style, and summarize what changed. Be honest about limitations.
 
-        For web research, use web_search to discover sources, fetch_content for important human-readable pages, and fetch_raw for machine-readable resources such as JSON, YAML, XML, RSS, OpenAPI specs, and plain text. Prefer official or primary sources and cite or mention the URLs you relied on.
+        When web tools are available, use web_search to discover sources, fetch_content for important human-readable pages, and fetch_raw for machine-readable resources such as JSON, YAML, XML, RSS, OpenAPI specs, and plain text. Prefer official or primary sources and cite or mention the URLs you relied on. Use code_search for package, GitHub repository, and source-code research.
 
-        Manage code context deliberately. Prefer context_for_task, summarize_file_structure, and read_file mode="outline"/"preview" before broad reads. Escalate to read_file mode="range" for exact lines, and use mode="full" only when focused context is insufficient. Use context_budget_stats when asked about context savings.
+        Manage code context deliberately. Prefer context_for_task, summarize_file_structure, and read_file mode="outline"/"preview" before broad reads. Escalate to read_file mode="range" for exact lines, and use mode="full" only when focused context is insufficient. If output is compacted or replaced with a duplicate reference, use retrieve_tool_output to inspect the needed original detail. Use context_budget_stats when asked about context savings. When a material requirement is ambiguous, use ask_user_question when it is available; otherwise state the assumption.
       PROMPT
     end
 
@@ -73,6 +75,7 @@ module Kward
     end
 
     def config_agents_prompt_source
+      return nil unless ConfigFiles.include_config_principles?
       return ConfigFiles.config_principles_path if File.exist?(ConfigFiles.config_principles_path)
       return ConfigFiles.config_agents_path if File.exist?(ConfigFiles.config_agents_path)
 
@@ -112,6 +115,14 @@ module Kward
       "Workspace AGENTS.md hint"
     end
 
+    def replacement_prompt_sections
+      path = ConfigFiles.system_prompt_file_path
+      content = ConfigFiles.system_prompt_file
+      return [] if content.to_s.empty?
+
+      [prompt_section("Custom system prompt (replacement)", content, source: path)]
+    end
+
     def prompt_section(label, content, source: nil)
       return nil if content.to_s.empty?
 
@@ -123,8 +134,8 @@ module Kward
 
       lines = [
         "Agent Skills are available.",
-        "When a task matches a skill's description, use read_skill to load its instructions before proceeding.",
-        "Use read_skill with a relative path to read referenced files inside a skill directory.",
+        "When read_skill is available and a task matches a skill's description, use it to load the instructions before proceeding.",
+        "When using read_skill, use a relative path to read referenced files inside a skill directory.",
         "Available skills:"
       ]
       skills.each do |skill|

data/lib/kward/rpc/plugin_chat_manager.rb

@@ -23,9 +23,10 @@ module Kward
       Chat = Struct.new(:id, :type, :driver, :queue, :worker, :running_turn_id, keyword_init: true)
       Turn = Struct.new(:id, :chat_id, :input, :display_input, :status, :cancellation, :created_at, :started_at, :finished_at, :events, :next_sequence, :error, :mutex, keyword_init: true)
 
-      def initialize(server:, client: Client.new)
+      def initialize(server:, client: Client.new, plugin_registry_provider: nil)
         @server = server
         @client = client
+        @plugin_registry_provider = plugin_registry_provider
         @chats = {}
         @turns = {}
         @subscriptions = {}
@@ -132,6 +133,8 @@ module Kward
       private
 
       def plugin_registry
+        return @plugin_registry_provider.call if @plugin_registry_provider
+
         @plugin_registry ||= PluginRegistry.load
       end
 

data/lib/kward/rpc/server.rb

@@ -5,7 +5,7 @@ require_relative "../memory/manager"
 require_relative "../plugin_registry"
 require_relative "../prompts/commands"
 require_relative "../tools/registry"
-require_relative "../workspace"
+require_relative "../workspace_factory"
 require_relative "../telemetry/logger"
 require_relative "../telemetry/stats"
 require_relative "auth_manager"
@@ -73,6 +73,7 @@ module Kward
         "memory/why", "memory/summarize"
       ].freeze
       COMMAND_METHODS = ["commands/list", "commands/run"].freeze
+      SKILL_CAPTURE_METHODS = ["skills/captureSessions", "skills/captureDraft", "skills/saveCapturedDraft"].freeze
       STARTUP_RESOURCE_METHODS = ["resources/startup"].freeze
       CONFIG_METHODS = ["config/read", "config/update"].freeze
       LOGGING_METHODS = ["logging/stats", "logging/tokenCsv"].freeze
@@ -101,6 +102,7 @@ module Kward
         auth: AUTH_METHODS,
         memory: MEMORY_METHODS,
         commands: COMMAND_METHODS,
+        skill_capture: SKILL_CAPTURE_METHODS,
         startup_resources: STARTUP_RESOURCE_METHODS,
         config: CONFIG_METHODS,
         logging: LOGGING_METHODS,
@@ -122,7 +124,11 @@ module Kward
         @client = client
         @config_manager = ConfigManager.new
         @session_manager = SessionManager.new(server: self, client: client, config_manager: @config_manager)
-        @plugin_chat_manager = PluginChatManager.new(server: self, client: client)
+        @plugin_chat_manager = PluginChatManager.new(
+          server: self,
+          client: client,
+          plugin_registry_provider: -> { @session_manager.plugin_registry }
+        )
         @auth_manager = AuthManager.new(server: self, config_manager: @config_manager)
         @shutdown = false
       end
@@ -247,6 +253,12 @@ module Kward
           commands_list(params)
         when COMMAND_METHODS[1]
           commands_run(params)
+        when SKILL_CAPTURE_METHODS[0]
+          { sessions: @session_manager.skill_capture_sessions }
+        when SKILL_CAPTURE_METHODS[1]
+          @session_manager.capture_skill(session_path: params.fetch("sessionPath"))
+        when SKILL_CAPTURE_METHODS[2]
+          @session_manager.save_captured_skill(content: params.fetch("content"), overwrite: params["overwrite"] == true)
         when STARTUP_RESOURCE_METHODS[0]
           startup_resources(params)
         when CONFIG_METHODS[0]
@@ -520,6 +532,7 @@ module Kward
           memory: { supported: true, optIn: true, defaultEnabled: false, autoSummaryDefaultEnabled: false, promptInjection: "interactive", storage: { core: "json", soft: "jsonl", events: "jsonl" }, methods: MEMORY_METHODS },
           stability: { protocol: "stable", compatibility: "additive-fields-unless-protocol-version-changes", experimentalCapabilities: [] },
           commands: { supported: true, methods: COMMAND_METHODS, method: COMMAND_METHODS[0], runMethod: COMMAND_METHODS[1], sources: ["builtin", "prompt", "skill", "plugin"], executableSources: ["builtin", "plugin"] },
+          skillCapture: { supported: true, methods: SKILL_CAPTURE_METHODS, destination: "personal", source: "savedSessionActiveLeaf", reviewRequired: true, overwrite: "explicit", autoActivate: false },
           mcp: {
             supported: true,
             transport: "stdio",
@@ -556,7 +569,8 @@ module Kward
             workspaceMutationGuard: "none",
             toolApproval: { supported: true, defaultMode: "none", modes: ["none", "ask"], requestNotification: TOOL_APPROVAL_NOTIFICATION, answerMethod: TOOL_APPROVAL_METHODS.first },
             canRunShell: true,
-            canWriteFiles: true
+            canWriteFiles: true,
+            sandbox: sandbox_capabilities
           },
           export: { supported: true, formats: ["markdown", "html"], defaultFormat: "markdown" },
           logging: {
@@ -576,6 +590,30 @@ module Kward
         }
       end
 
+      def sandbox_capabilities
+        config = @config_manager.read(redacted: false)
+        policy = ConfigFiles.sandbox_policy(Dir.pwd, config)
+        runner = Sandbox::RunnerFactory.build(policy)
+        runner.capabilities.to_h.merge(
+          mode: policy.mode,
+          network: policy.network,
+          scope: "shellCommandsOnly",
+          sessionPinning: false,
+          oneTimeElevation: false
+        )
+      rescue ArgumentError => error
+        {
+          available: false,
+          filesystemEnforced: false,
+          childNetworkEnforced: false,
+          backend: "invalidConfiguration",
+          reason: error.message,
+          scope: "shellCommandsOnly",
+          sessionPinning: false,
+          oneTimeElevation: false
+        }
+      end
+
       def workspace_info(root)
         root = @session_manager.validate_workspace_root(root)
         { root: root, basename: File.basename(root), writable: File.writable?(root) }
@@ -797,7 +835,7 @@ module Kward
       end
 
       def configured_workspace(root = Dir.pwd)
-        Workspace.new(root: root, guardrails: workspace_guardrails_enabled?)
+        WorkspaceFactory.build(root: root, guardrails: workspace_guardrails_enabled?, config: @config_manager.read(redacted: false))
       end
 
       def workspace_guardrails_enabled?

data/lib/kward/rpc/session_manager.rb

@@ -15,6 +15,7 @@ require_relative "../memory/turn_context"
 require_relative "../message_access"
 require_relative "../message_text"
 require_relative "../session_tree_tool_display"
+require_relative "../skills/capture"
 require_relative "../model/model_info"
 require_relative "../plugin_registry"
 require_relative "../prompts/commands"
@@ -25,7 +26,7 @@ require_relative "../steering"
 require_relative "../tools/tool_call"
 require_relative "../tools/registry"
 require_relative "../transcript_export"
-require_relative "../workspace"
+require_relative "../workspace_factory"
 require_relative "attachment_normalizer"
 require_relative "config_manager"
 require_relative "memory_methods"
@@ -155,6 +156,38 @@ module Kward
         { sessions: @mutex.synchronize { @sessions.values.map { |rpc_session| session_payload(rpc_session) } } }
       end
 
+      def skill_capture_sessions
+        SessionStore.new(config_dir: @config_dir).capture_candidates.map do |session|
+          {
+            path: session.path,
+            workspaceRoot: session.cwd,
+            name: session.name,
+            firstMessage: session.first_message,
+            modifiedAt: session.modified_at.utc.iso8601(3)
+          }
+        end
+      end
+
+      def capture_skill(session_path:)
+        capture = Skills::Capture.new(
+          session_store: SessionStore.new(config_dir: @config_dir),
+          client: @client,
+          config_dir: @config_dir
+        )
+        draft = capture.generate(session_path)
+        { content: draft.content, sourcePath: draft.source_path, name: draft.name, description: draft.description }
+      end
+
+      def save_captured_skill(content:, overwrite: false)
+        capture = Skills::Capture.new(
+          session_store: SessionStore.new(config_dir: @config_dir),
+          client: @client,
+          config_dir: @config_dir
+        )
+        draft = capture.save(content, overwrite: overwrite)
+        { path: capture.skill_path(draft.name), name: draft.name, description: draft.description }
+      end
+
       def tool_schemas(session_id: nil)
         registry = if session_id
                      fetch_session(session_id).tool_registry
@@ -164,6 +197,11 @@ module Kward
         { tools: registry.schemas }
       end
 
+      # Returns the plugin registry shared by RPC sessions and plugin chats.
+      def plugin_registry
+        @plugin_registry ||= PluginRegistry.load(reserved_commands: reserved_plugin_command_names)
+      end
+
       # Renames the persisted session attached to an RPC session id.
       def rename_session(session_id:, name:)
         rpc_session = fetch_session(session_id)
@@ -919,10 +957,6 @@ module Kward
         end
       end
 
-      def plugin_registry
-        @plugin_registry ||= PluginRegistry.load(reserved_commands: reserved_plugin_command_names)
-      end
-
       def reserved_plugin_command_names
         PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES + ConfigFiles.prompt_templates(reserved_commands: PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES).map(&:command)
       end
@@ -1019,7 +1053,7 @@ module Kward
       end
 
       def configured_workspace(root)
-        Workspace.new(root: root, guardrails: workspace_guardrails_enabled?)
+        WorkspaceFactory.build(root: root, guardrails: workspace_guardrails_enabled?, config: @config_manager.read(redacted: false))
       end
 
       def workspace_guardrails_enabled?
@@ -1161,6 +1195,8 @@ module Kward
         started, event = turn.mutex.synchronize do
           next [false, nil] if turn.status == "canceled"
 
+          rpc_session.running_turn_id = turn.id
+          turn.steering = build_steering(turn) if supports_in_flight_steer? && !turn.plugin_command_name
           turn.status = "running"
           turn.started_at = now
           [true, append_turn_event_locked(turn, "turnStarted", { status: "running" })]
@@ -1168,8 +1204,6 @@ module Kward
         return unless started
 
         @server.notify("turn/event", event)
-        rpc_session.running_turn_id = turn.id
-        turn.steering = build_steering(turn) if supports_in_flight_steer? && !turn.plugin_command_name
 
         if turn.cancel_requested
           finish_turn(turn, "canceled")

data/lib/kward/sandbox/capabilities.rb

@@ -0,0 +1,39 @@
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Describes the enforcement a platform runner can provide.
+    class Capabilities
+      attr_reader :backend, :reason
+
+      def initialize(available:, filesystem_enforced:, child_network_enforced:, backend:, reason: nil)
+        @available = available == true
+        @filesystem_enforced = filesystem_enforced == true
+        @child_network_enforced = child_network_enforced == true
+        @backend = backend.to_s
+        @reason = reason&.to_s
+      end
+
+      def available?
+        @available
+      end
+
+      def filesystem_enforced?
+        @filesystem_enforced
+      end
+
+      def child_network_enforced?
+        @child_network_enforced
+      end
+
+      def to_h
+        {
+          available: available?,
+          filesystemEnforced: filesystem_enforced?,
+          childNetworkEnforced: child_network_enforced?,
+          backend: backend,
+          reason: reason
+        }.compact
+      end
+    end
+  end
+end

data/lib/kward/sandbox/command_runner.rb

@@ -0,0 +1,28 @@
+require_relative "../local_command_runner"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Base command runner. Platform runners provide an argv that is then executed
+    # through LocalCommandRunner, preserving Kward's timeout and cancellation behavior.
+    class CommandRunner
+      def initialize(policy:, capabilities:)
+        @policy = policy
+        @capabilities = capabilities
+      end
+
+      attr_reader :policy, :capabilities
+
+      def run(command, cwd:, timeout_seconds:, max_output_bytes:, cancellation: nil, &block)
+        LocalCommandRunner.new(
+          timeout_seconds: timeout_seconds,
+          max_output_bytes: max_output_bytes
+        ).run(*command_argv(command, cwd: cwd), cwd: cwd, cancellation: cancellation, &block)
+      end
+
+      def command_argv(command, cwd:)
+        raise NotImplementedError, "#{self.class} must implement #command_argv"
+      end
+    end
+  end
+end

data/lib/kward/sandbox/environment.rb

@@ -0,0 +1,24 @@
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Builds a minimal environment for sandboxed command workers. In particular,
+    # credentials and language-runtime injection variables are not inherited.
+    module Environment
+      SAFE_VARIABLES = %w[PATH LANG LC_ALL LC_CTYPE TERM COLORTERM NO_COLOR].freeze
+
+      module_function
+
+      def command_worker(temporary_root, source: ENV)
+        SAFE_VARIABLES.each_with_object({}) do |name, environment|
+          value = source[name].to_s
+          environment[name] = value unless value.empty?
+        end.merge(
+          "HOME" => temporary_root,
+          "TMPDIR" => temporary_root,
+          "TMP" => temporary_root,
+          "TEMP" => temporary_root
+        )
+      end
+    end
+  end
+end

data/lib/kward/sandbox/linux_bubblewrap_runner.rb

@@ -0,0 +1,71 @@
+require "fileutils"
+require "tmpdir"
+require_relative "command_runner"
+require_relative "environment"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Runs a command in a Bubblewrap mount namespace on Linux.
+    class LinuxBubblewrapRunner < CommandRunner
+      def self.executable
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).filter_map do |directory|
+          path = File.expand_path("bwrap", directory)
+          path if File.file?(path) && File.executable?(path)
+        end.first
+      end
+
+      def self.capabilities(platform: RUBY_PLATFORM, executable: self.executable)
+        available = platform.to_s.include?("linux") && !executable.to_s.empty?
+        return Capabilities.new(available: true, filesystem_enforced: true, child_network_enforced: true, backend: "linux_bubblewrap") if available
+
+        Capabilities.new(
+          available: false,
+          filesystem_enforced: false,
+          child_network_enforced: false,
+          backend: "linux_bubblewrap",
+          reason: "Bubblewrap is unavailable"
+        )
+      end
+
+      def initialize(policy:, executable: self.class.executable, capabilities: self.class.capabilities(executable: executable))
+        raise ArgumentError, "Linux Bubblewrap is unavailable: #{capabilities.reason}" unless capabilities.available?
+
+        super(policy:, capabilities:)
+        @executable = executable
+      end
+
+      def run(command, cwd:, timeout_seconds:, max_output_bytes:, cancellation: nil, &block)
+        temporary_root = Dir.mktmpdir("kward-sandbox")
+        environment = Environment.command_worker(temporary_root)
+
+        LocalCommandRunner.new(
+          timeout_seconds: timeout_seconds,
+          max_output_bytes: max_output_bytes
+        ).run(
+          *command_argv(command, cwd: cwd, temporary_root: temporary_root),
+          env: environment,
+          cwd: cwd,
+          cancellation: cancellation,
+          unsetenv_others: true,
+          &block
+        )
+      ensure
+        FileUtils.remove_entry(temporary_root) if temporary_root && File.exist?(temporary_root)
+      end
+
+      def command_argv(command, cwd:, temporary_root: nil)
+        temporary_root ||= Dir.tmpdir
+        workspace_root = policy.workspace_root
+        writable_roots = policy.command_writable_roots + [File.realpath(temporary_root)]
+        argv = [@executable, "--die-with-parent", "--new-session", "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc"]
+        argv << "--unshare-net" unless policy.child_network_allowed?
+        argv.concat(["--bind", workspace_root, workspace_root]) if policy.workspace_write?
+        writable_roots.reject { |path| path == workspace_root }.each { |path| argv.concat(["--bind", path, path]) }
+        argv.concat(["--ro-bind", File.join(workspace_root, ".git"), File.join(workspace_root, ".git")]) if policy.protect_git_metadata? && File.exist?(File.join(workspace_root, ".git"))
+        argv.concat(["--setenv", "TMPDIR", temporary_root, "--setenv", "TMP", temporary_root, "--setenv", "TEMP", temporary_root])
+        argv.concat(["--chdir", cwd.to_s, "--", "/bin/sh", "-lc", command.to_s])
+      end
+    end
+  end
+end

data/lib/kward/sandbox/macos_seatbelt_runner.rb

@@ -0,0 +1,96 @@
+require "fileutils"
+require "tmpdir"
+require_relative "command_runner"
+require_relative "environment"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Runs a command under macOS Seatbelt. This backend deliberately constrains
+    # writes and child networking first; host-process and plugin access remain
+    # outside the command worker boundary.
+    class MacOSSeatbeltRunner < CommandRunner
+      EXECUTABLE = "/usr/bin/sandbox-exec".freeze
+      PROTECTED_READ_DIRECTORIES = %w[.aws .gnupg .kward .ssh .config/gcloud .config/gh].freeze
+
+      def self.capabilities(platform: RUBY_PLATFORM)
+        available = platform.to_s.include?("darwin") && File.executable?(EXECUTABLE)
+        return Capabilities.new(available: true, filesystem_enforced: true, child_network_enforced: true, backend: "macos_seatbelt") if available
+
+        Capabilities.new(
+          available: false,
+          filesystem_enforced: false,
+          child_network_enforced: false,
+          backend: "macos_seatbelt",
+          reason: "#{EXECUTABLE} is unavailable"
+        )
+      end
+
+      def initialize(policy:, capabilities: self.class.capabilities)
+        raise ArgumentError, "macOS Seatbelt is unavailable: #{capabilities.reason}" unless capabilities.available?
+
+        super
+      end
+
+      def run(command, cwd:, timeout_seconds:, max_output_bytes:, cancellation: nil, &block)
+        temporary_root = Dir.mktmpdir("kward-sandbox")
+        environment = Environment.command_worker(temporary_root)
+
+        LocalCommandRunner.new(
+          timeout_seconds: timeout_seconds,
+          max_output_bytes: max_output_bytes
+        ).run(
+          *command_argv(command, cwd: cwd, temporary_root: temporary_root),
+          env: environment,
+          cwd: cwd,
+          cancellation: cancellation,
+          unsetenv_others: true,
+          &block
+        )
+      ensure
+        FileUtils.remove_entry(temporary_root) if temporary_root && File.exist?(temporary_root)
+      end
+
+      def command_argv(command, cwd:, temporary_root: nil)
+        temporary_root ||= Dir.tmpdir
+        [EXECUTABLE, "-p", profile(temporary_root), "/bin/zsh", "-lc", command.to_s]
+      end
+
+      private
+
+      def profile(temporary_root)
+        writable_roots = policy.command_writable_roots + [File.realpath(temporary_root)]
+        rules = [
+          "(version 1)",
+          "(deny default)",
+          "(allow process*)",
+          "(allow signal)",
+          "(allow file-read*)",
+          "(allow file-write-data (literal \"/dev/null\"))",
+          "(allow sysctl-read)",
+          "(allow mach-lookup)",
+          "(allow ipc-posix-shm*)",
+          "(allow user-preference-read)",
+          "(allow pseudo-tty)"
+        ]
+        rules << "(allow network*)" if policy.child_network_allowed?
+        rules.concat(writable_roots.map { |path| "(allow file-write* (subpath #{seatbelt_string(path)}))" })
+        rules.concat(protected_read_roots.map { |path| "(deny file-read* (subpath #{seatbelt_string(path)}))" })
+        rules << "(deny file-write* (subpath #{seatbelt_string(File.join(policy.workspace_root, ".git"))}))" if policy.protect_git_metadata?
+        rules.join("\n")
+      end
+
+      def protected_read_roots
+        home = ENV.fetch("HOME", Dir.home)
+        PROTECTED_READ_DIRECTORIES.map do |path|
+          root = File.join(home, path)
+          File.exist?(root) ? File.realpath(root) : root
+        end
+      end
+
+      def seatbelt_string(value)
+        %Q{"#{value.to_s.gsub(/([\\"])/, '\\\\1')}"}
+      end
+    end
+  end
+end

data/lib/kward/sandbox/passthrough_runner.rb

@@ -0,0 +1,13 @@
+require_relative "command_runner"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Preserves existing LocalCommandRunner behavior when sandboxing is off.
+    class PassthroughRunner < CommandRunner
+      def command_argv(command, cwd:)
+        [command.to_s]
+      end
+    end
+  end
+end