kward 0.78.0 → 0.80.0

data/lib/kward/rpc/session_manager.rb

@@ -15,6 +15,7 @@ require_relative "../memory/turn_context"
 require_relative "../message_access"
 require_relative "../message_text"
 require_relative "../session_tree_tool_display"
+require_relative "../skills/capture"
 require_relative "../model/model_info"
 require_relative "../plugin_registry"
 require_relative "../prompts/commands"
@@ -25,7 +26,7 @@ require_relative "../steering"
 require_relative "../tools/tool_call"
 require_relative "../tools/registry"
 require_relative "../transcript_export"
-require_relative "../workspace"
+require_relative "../workspace_factory"
 require_relative "attachment_normalizer"
 require_relative "config_manager"
 require_relative "memory_methods"
@@ -65,8 +66,8 @@ module Kward
       WORKER_STOP_TIMEOUT = 2.0
       WORKER_STOP = Object.new.freeze
 
-      RpcSession = Struct.new(:id, :workspace_root, :store, :session, :conversation, :agent, :tool_registry, :prompt, :plugin_output, :queue, :worker, :running_turn_id, :footer_worker, :last_footer_text, keyword_init: true)
-      Turn = Struct.new(:id, :session_id, :input, :display_input, :status, :cancel_requested, :cancellation, :created_at, :started_at, :finished_at, :events, :next_sequence, :error, :streaming_behavior, :plugin_command_name, :plugin_arguments, :steering, :options, :tool_registry, :mutex, keyword_init: true)
+      RpcSession = Struct.new(:id, :workspace_root, :store, :session, :conversation, :agent, :tool_registry, :execution_profile, :prompt, :plugin_output, :queue, :worker, :running_turn_id, :footer_worker, :last_footer_text, keyword_init: true)
+      Turn = Struct.new(:id, :session_id, :input, :display_input, :status, :cancel_requested, :cancellation, :created_at, :started_at, :finished_at, :events, :next_sequence, :error, :streaming_behavior, :plugin_command_name, :plugin_arguments, :steering, :options, :tool_registry, :execution_profile, :mutex, keyword_init: true)
 
       # Creates an object for RPC session lifecycle and turn coordination.
       def initialize(
@@ -76,7 +77,8 @@ module Kward
         config_manager: ConfigManager.new(config_path: File.join(config_dir, "config.json")),
         context_usage: ContextUsage.new,
         session_trash: SessionTrash.new,
-        worker_stop_timeout: WORKER_STOP_TIMEOUT
+        worker_stop_timeout: WORKER_STOP_TIMEOUT,
+        event_listener: nil
       )
         @server = server
         @client = client
@@ -86,6 +88,7 @@ module Kward
         @session_metrics = SessionMetrics.new(context_usage: context_usage)
         @session_trash = session_trash
         @worker_stop_timeout = worker_stop_timeout
+        @event_listeners = event_listener ? [event_listener] : []
         @sessions = {}
         @turns = {}
         @mutex = Mutex.new
@@ -96,26 +99,28 @@ module Kward
       # Returns the normalized session payload expected by RPC clients. The RPC
       # session id is separate from the persisted session id so one persisted file
       # can be closed and reopened by different client connections.
-      def create_session(workspace_root: Dir.pwd, name: nil, resume_last: false)
+      def create_session(workspace_root: Dir.pwd, name: nil, resume_last: false, execution_profile: nil)
+        execution_profile = validate_execution_profile(execution_profile)
         workspace_root = validate_workspace_root(workspace_root)
         store = SessionStore.new(config_dir: @config_dir, cwd: workspace_root)
         if resume_last && session_auto_resume_enabled? && name.to_s.strip.empty?
           path = store.remembered_last_session_path
-          return resume_session(path: path, workspace_root: workspace_root, include_transcript: true) if path
+          return resume_session(path: path, workspace_root: workspace_root, include_transcript: true, execution_profile: execution_profile) if path
         end
 
-        conversation = new_conversation(workspace_root: workspace_root)
+        conversation = new_conversation(workspace_root: workspace_root, execution_profile: execution_profile)
         session = store.create(provider: conversation.provider, model: conversation.model, reasoning_effort: conversation.reasoning_effort)
         session.rename(name) unless name.to_s.strip.empty?
         session.attach(conversation)
-        rpc_session = build_rpc_session(store, session, conversation, workspace_root)
+        rpc_session = build_rpc_session(store, session, conversation, workspace_root, execution_profile: execution_profile)
         remember_session(rpc_session)
         cleanup_other_unused_sessions(rpc_session)
         emit_footer_update(rpc_session)
         session_payload(rpc_session)
       end
 
-      def resume_session(path:, workspace_root: nil, include_transcript: false)
+      def resume_session(path:, workspace_root: nil, include_transcript: false, execution_profile: nil)
+        execution_profile = validate_execution_profile(execution_profile)
         root = validate_workspace_root(workspace_root || Dir.pwd)
         store = SessionStore.new(config_dir: @config_dir, cwd: root)
         location = store.session_location(path)
@@ -128,7 +133,8 @@ module Kward
           model: current_model_id,
           reasoning_effort: current_reasoning_effort
         )
-        rpc_session = build_rpc_session(store, session, conversation, root)
+        conversation.update_execution_profile_context!(execution_profile.prompt_context) if execution_profile
+        rpc_session = build_rpc_session(store, session, conversation, root, execution_profile: execution_profile)
         remember_session(rpc_session)
         cleanup_other_unused_sessions(rpc_session)
         emit_footer_update(rpc_session)
@@ -155,6 +161,38 @@ module Kward
         { sessions: @mutex.synchronize { @sessions.values.map { |rpc_session| session_payload(rpc_session) } } }
       end
 
+      def skill_capture_sessions
+        SessionStore.new(config_dir: @config_dir).capture_candidates.map do |session|
+          {
+            path: session.path,
+            workspaceRoot: session.cwd,
+            name: session.name,
+            firstMessage: session.first_message,
+            modifiedAt: session.modified_at.utc.iso8601(3)
+          }
+        end
+      end
+
+      def capture_skill(session_path:)
+        capture = Skills::Capture.new(
+          session_store: SessionStore.new(config_dir: @config_dir),
+          client: @client,
+          config_dir: @config_dir
+        )
+        draft = capture.generate(session_path)
+        { content: draft.content, sourcePath: draft.source_path, name: draft.name, description: draft.description }
+      end
+
+      def save_captured_skill(content:, overwrite: false)
+        capture = Skills::Capture.new(
+          session_store: SessionStore.new(config_dir: @config_dir),
+          client: @client,
+          config_dir: @config_dir
+        )
+        draft = capture.save(content, overwrite: overwrite)
+        { path: capture.skill_path(draft.name), name: draft.name, description: draft.description }
+      end
+
       def tool_schemas(session_id: nil)
         registry = if session_id
                      fetch_session(session_id).tool_registry
@@ -164,6 +202,22 @@ module Kward
         { tools: registry.schemas }
       end
 
+      # Subscribes to frontend-neutral runtime notifications.
+      #
+      # Subscribers are isolated from session execution: an exception is logged
+      # and does not interrupt the RPC notification or active turn.
+      def subscribe_events(&listener)
+        raise ArgumentError, "event subscription requires a block" unless listener
+
+        @mutex.synchronize { @event_listeners << listener }
+        listener
+      end
+
+      # Returns the plugin registry shared by RPC sessions and plugin chats.
+      def plugin_registry
+        @plugin_registry ||= PluginRegistry.load(reserved_commands: reserved_plugin_command_names)
+      end
+
       # Renames the persisted session attached to an RPC session id.
       def rename_session(session_id:, name:)
         rpc_session = fetch_session(session_id)
@@ -175,7 +229,8 @@ module Kward
       def clone_session(session_id:)
         source = fetch_session(session_id)
         session, conversation = source.store.create_independent_from_conversation(source.conversation, parent_session: source.session)
-        rpc_session = build_rpc_session(source.store, session, conversation, source.workspace_root)
+        conversation.update_execution_profile_context!(source.execution_profile.prompt_context) if source.execution_profile
+        rpc_session = build_rpc_session(source.store, session, conversation, source.workspace_root, execution_profile: source.execution_profile)
         remember_session(rpc_session)
         cleanup_other_unused_sessions(rpc_session)
         emit_footer_update(rpc_session)
@@ -234,7 +289,8 @@ module Kward
           parent_session: source.session
         )
 
-        rpc_session = build_rpc_session(source.store, session, conversation, source.workspace_root)
+        conversation.update_execution_profile_context!(source.execution_profile.prompt_context) if source.execution_profile
+        rpc_session = build_rpc_session(source.store, session, conversation, source.workspace_root, execution_profile: source.execution_profile)
         remember_session(rpc_session)
         cleanup_other_unused_sessions(rpc_session)
         {
@@ -348,12 +404,20 @@ module Kward
       # queue a follow-up, or steer the running turn when the active provider
       # supports native steering. The returned turn id is used for status,
       # cancellation, and event replay.
-      def start_turn(session_id:, input:, streaming_behavior: nil, attachments: [], options: {}, context: nil)
+      def start_turn(session_id:, input:, streaming_behavior: nil, attachments: [], options: {}, context: nil, execution_profile: nil)
         rpc_session = fetch_session(session_id)
-        normalized_options = normalize_turn_options(options)
+        execution_profile = validate_execution_profile(execution_profile)
+        normalized_options = enforce_execution_profile_options(normalize_turn_options(options), execution_profile)
         normalized_context = TurnContext.normalize(context)
         normalized_attachments = normalize_attachments(attachments)
-        plugin_command, plugin_arguments = plugin_command_turn(input, normalized_attachments)
+        if execution_profile && !execution_profile.attachments && !normalized_attachments.empty?
+          raise ArgumentError, "transport execution profile does not allow attachments"
+        end
+        plugin_command, plugin_arguments = if execution_profile && !execution_profile.plugin_commands
+                                              [nil, ""]
+                                            else
+                                              plugin_command_turn(input, normalized_attachments)
+                                            end
         display_input = input.to_s if input.is_a?(String)
         content = plugin_command ? input.to_s : user_turn_content(turn_input_with_context(expand_prompt_input(input), normalized_context), normalized_attachments)
         streaming_behavior = validate_streaming_behavior(default_streaming_behavior(rpc_session, streaming_behavior), rpc_session: rpc_session)
@@ -376,6 +440,7 @@ module Kward
           plugin_arguments: plugin_arguments,
           options: normalized_options,
           tool_registry: scoped_tool_registry(rpc_session, normalized_options),
+          execution_profile: execution_profile,
           mutex: Mutex.new
         )
         @mutex.synchronize { @turns[turn.id] = turn }
@@ -391,7 +456,7 @@ module Kward
           turn.cancel_requested = true
           [turn.status == "queued", append_turn_event_locked(turn, "turnCancelRequested", {})]
         end
-        @server.notify("turn/event", event)
+        notify("turn/event", event)
         turn.cancellation&.cancel!
         finish_turn(turn, "canceled") if queued
         turn_payload(turn)
@@ -480,6 +545,11 @@ module Kward
         normalized
       end
 
+      def refresh_models(provider: nil)
+        @client.refresh_available_models(provider: provider) if @client.respond_to?(:refresh_available_models)
+        available_models
+      end
+
       def current_model
         provider = @client.respond_to?(:current_provider) ? @client.current_provider : nil
         model = @client.respond_to?(:current_model) ? @client.current_model : nil
@@ -585,7 +655,9 @@ module Kward
       end
 
       def session_modified_at(session)
-        File.exist?(session.path) ? File.mtime(session.path) : nil
+        return nil unless File.exist?(session.path)
+
+        session.respond_to?(:modified_at) ? session.modified_at : nil
       end
 
       def validate_workspace_root(root)
@@ -597,9 +669,22 @@ module Kward
 
       private
 
-      def new_conversation(workspace_root: Dir.pwd)
+      def notify(method, payload)
+        @server.notify(method, payload)
+        listeners = @mutex.synchronize { @event_listeners.dup }
+        listeners.each do |listener|
+          begin
+            listener.call(method, payload)
+          rescue StandardError => e
+            @server.log_error(e) if @server.respond_to?(:log_error)
+          end
+        end
+      end
+
+      def new_conversation(workspace_root: Dir.pwd, execution_profile: nil)
         Conversation.new(
           workspace_root: workspace_root,
+          execution_profile_context: execution_profile&.prompt_context,
           provider: (@client.current_provider if @client.respond_to?(:current_provider)),
           model: (@client.current_model if @client.respond_to?(:current_model)),
           reasoning_effort: (@client.current_reasoning_effort if @client.respond_to?(:current_reasoning_effort)),
@@ -742,6 +827,7 @@ module Kward
           reasoning_effort: current_reasoning_effort
         )
         conversation.plugin_registry ||= plugin_registry if conversation.respond_to?(:plugin_registry)
+        conversation.update_execution_profile_context!(rpc_session.execution_profile.prompt_context) if rpc_session.execution_profile
         rpc_session.session = session
         rpc_session.conversation = conversation
         rebuild_session_tools(rpc_session)
@@ -818,6 +904,30 @@ module Kward
         PromptCommands.expand(input) || input
       end
 
+      def validate_execution_profile(profile)
+        return nil if profile.nil?
+        return profile if profile.is_a?(Kward::Transport::ExecutionProfile)
+
+        raise ArgumentError, "execution_profile must be a Transport::ExecutionProfile"
+      end
+
+      def enforce_execution_profile_options(options, profile)
+        return options unless profile
+
+        options = options.dup
+        case profile.tool_mode
+        when :none
+          options.delete(:disabled_tools)
+          options[:allowed_tools] = []
+        when :allowlist
+          options.delete(:disabled_tools)
+          options[:allowed_tools] = profile.allowed_tools
+        end
+        options[:approval_mode] = "none" if profile.approval_mode == :deny
+        options[:approval_mode] = "ask" if profile.approval_mode == :ask
+        options
+      end
+
       def plugin_command_turn(input, attachments)
         return [nil, ""] unless input.is_a?(String)
         return [nil, ""] unless attachments.empty?
@@ -919,10 +1029,6 @@ module Kward
         end
       end
 
-      def plugin_registry
-        @plugin_registry ||= PluginRegistry.load(reserved_commands: reserved_plugin_command_names)
-      end
-
       def reserved_plugin_command_names
         PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES + ConfigFiles.prompt_templates(reserved_commands: PromptCommands::BUILTIN_RESERVED_COMMAND_NAMES).map(&:command)
       end
@@ -932,10 +1038,10 @@ module Kward
       # This is the RPC counterpart to the CLI interactive setup: attach plugin
       # context, create a prompt bridge for UI questions/footer output, advertise
       # tools with the workspace guardrail policy, and build the shared `Agent`.
-      def build_rpc_session(store, session, conversation, workspace_root)
+      def build_rpc_session(store, session, conversation, workspace_root, execution_profile: nil)
         conversation.plugin_registry ||= plugin_registry if conversation.respond_to?(:plugin_registry)
         id = SecureRandom.uuid
-        prompt = PromptBridge.new(server: @server, session_id: id)
+        prompt = PromptBridge.new(notify: method(:notify), session_id: id)
         hook_context = lifecycle_hook_context(conversation: conversation, session: session, workspace_root: workspace_root)
         hook_manager = lifecycle_hook_manager(workspace_root)
         tool_registry = build_tool_registry(workspace_root, prompt, hook_manager: hook_manager, hook_context: hook_context)
@@ -954,6 +1060,7 @@ module Kward
           conversation: conversation,
           agent: agent,
           tool_registry: tool_registry,
+          execution_profile: execution_profile,
           prompt: prompt,
           plugin_output: [],
           queue: Queue.new,
@@ -986,7 +1093,7 @@ module Kward
       end
 
       def emit_lifecycle_hook_event(event, result)
-        @server.notify("hook/event", {
+        notify("hook/event", {
           event: {
             id: event.id,
             name: event.name,
@@ -1014,12 +1121,12 @@ module Kward
           args: "",
           session: session,
           workspace_root: workspace_root,
-          say_callback: lambda { |message| @server.notify("hook/message", { message: message.to_s }) }
+          say_callback: lambda { |message| notify("hook/message", { message: message.to_s }) }
         )
       end
 
       def configured_workspace(root)
-        Workspace.new(root: root, guardrails: workspace_guardrails_enabled?)
+        WorkspaceFactory.build(root: root, guardrails: workspace_guardrails_enabled?, config: @config_manager.read(redacted: false))
       end
 
       def workspace_guardrails_enabled?
@@ -1155,21 +1262,25 @@ module Kward
       # This method is intentionally the only place that calls `Agent#ask` for RPC
       # turns. Keep event translation near this boundary so CLI rendering and RPC
       # protocol details do not leak into `Agent`.
+      def memory_disabled?(turn)
+        turn.execution_profile&.memory == :none
+      end
+
       def run_turn(rpc_session, turn)
         previous_turn_id = Thread.current[:kward_rpc_turn_id]
         Thread.current[:kward_rpc_turn_id] = turn.id
         started, event = turn.mutex.synchronize do
           next [false, nil] if turn.status == "canceled"
 
+          rpc_session.running_turn_id = turn.id
+          turn.steering = build_steering(turn) if supports_in_flight_steer? && !turn.plugin_command_name
           turn.status = "running"
           turn.started_at = now
           [true, append_turn_event_locked(turn, "turnStarted", { status: "running" })]
         end
         return unless started
 
-        @server.notify("turn/event", event)
-        rpc_session.running_turn_id = turn.id
-        turn.steering = build_steering(turn) if supports_in_flight_steer? && !turn.plugin_command_name
+        notify("turn/event", event)
 
         if turn.cancel_requested
           finish_turn(turn, "canceled")
@@ -1180,15 +1291,17 @@ module Kward
           run_plugin_turn(rpc_session, turn)
         else
           auto_name_session(rpc_session, turn.display_input || turn.input)
-          prepare_memory_context(rpc_session.conversation, turn.input)
+          prepare_memory_context(rpc_session.conversation, turn.input) unless memory_disabled?(turn)
           rpc_session.agent.ask(turn.input, display_input: turn_display_input(turn), cancellation: turn.cancellation, steering: turn.steering, options: turn.options || {}, tool_registry: turn.tool_registry) do |event|
             next if turn.cancel_requested
 
             notify_plugin_transcript_event(rpc_session, event)
             handle_agent_event(turn, event)
           end
-          persist_memory_state(rpc_session)
-          auto_summarize_memory(rpc_session) unless turn.cancel_requested
+          unless memory_disabled?(turn)
+            persist_memory_state(rpc_session)
+            auto_summarize_memory(rpc_session) unless turn.cancel_requested
+          end
           finish_turn(turn, turn.cancel_requested ? "canceled" : "completed")
         end
       rescue Cancellation::CancelledError
@@ -1338,7 +1451,7 @@ module Kward
         end
         return unless event
 
-        @server.notify("turn/event", event)
+        notify("turn/event", event)
         rpc_session = @mutex.synchronize { @sessions[turn.session_id] }
         emit_footer_update(rpc_session) if rpc_session
       end
@@ -1357,19 +1470,19 @@ module Kward
         return if rpc_session.last_footer_text == text
 
         rpc_session.last_footer_text = text
-        @server.notify("ui/footer", { sessionId: rpc_session.id, text: text })
+        notify("ui/footer", { sessionId: rpc_session.id, text: text })
       end
 
       def clear_footer_update(rpc_session)
         return if rpc_session.last_footer_text.to_s.empty?
 
         rpc_session.last_footer_text = ""
-        @server.notify("ui/footer", { sessionId: rpc_session.id, text: "" })
+        notify("ui/footer", { sessionId: rpc_session.id, text: "" })
       end
 
       def emit_turn_event(turn, type, payload)
         event = turn.mutex.synchronize { append_turn_event_locked(turn, type, payload) }
-        @server.notify("turn/event", event)
+        notify("turn/event", event)
         event
       end
 
@@ -1389,7 +1502,7 @@ module Kward
       end
 
       def emit_session_event(rpc_session, type, payload)
-        @server.notify("session/event", {
+        notify("session/event", {
           timestamp: now,
           sessionId: rpc_session.id,
           type: type,

data/lib/kward/sandbox/capabilities.rb

@@ -0,0 +1,39 @@
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Describes the enforcement a platform runner can provide.
+    class Capabilities
+      attr_reader :backend, :reason
+
+      def initialize(available:, filesystem_enforced:, child_network_enforced:, backend:, reason: nil)
+        @available = available == true
+        @filesystem_enforced = filesystem_enforced == true
+        @child_network_enforced = child_network_enforced == true
+        @backend = backend.to_s
+        @reason = reason&.to_s
+      end
+
+      def available?
+        @available
+      end
+
+      def filesystem_enforced?
+        @filesystem_enforced
+      end
+
+      def child_network_enforced?
+        @child_network_enforced
+      end
+
+      def to_h
+        {
+          available: available?,
+          filesystemEnforced: filesystem_enforced?,
+          childNetworkEnforced: child_network_enforced?,
+          backend: backend,
+          reason: reason
+        }.compact
+      end
+    end
+  end
+end

data/lib/kward/sandbox/command_runner.rb

@@ -0,0 +1,28 @@
+require_relative "../local_command_runner"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Base command runner. Platform runners provide an argv that is then executed
+    # through LocalCommandRunner, preserving Kward's timeout and cancellation behavior.
+    class CommandRunner
+      def initialize(policy:, capabilities:)
+        @policy = policy
+        @capabilities = capabilities
+      end
+
+      attr_reader :policy, :capabilities
+
+      def run(command, cwd:, timeout_seconds:, max_output_bytes:, cancellation: nil, &block)
+        LocalCommandRunner.new(
+          timeout_seconds: timeout_seconds,
+          max_output_bytes: max_output_bytes
+        ).run(*command_argv(command, cwd: cwd), cwd: cwd, cancellation: cancellation, &block)
+      end
+
+      def command_argv(command, cwd:)
+        raise NotImplementedError, "#{self.class} must implement #command_argv"
+      end
+    end
+  end
+end

data/lib/kward/sandbox/environment.rb

@@ -0,0 +1,24 @@
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Builds a minimal environment for sandboxed command workers. In particular,
+    # credentials and language-runtime injection variables are not inherited.
+    module Environment
+      SAFE_VARIABLES = %w[PATH LANG LC_ALL LC_CTYPE TERM COLORTERM NO_COLOR].freeze
+
+      module_function
+
+      def command_worker(temporary_root, source: ENV)
+        SAFE_VARIABLES.each_with_object({}) do |name, environment|
+          value = source[name].to_s
+          environment[name] = value unless value.empty?
+        end.merge(
+          "HOME" => temporary_root,
+          "TMPDIR" => temporary_root,
+          "TMP" => temporary_root,
+          "TEMP" => temporary_root
+        )
+      end
+    end
+  end
+end

data/lib/kward/sandbox/linux_bubblewrap_runner.rb

@@ -0,0 +1,71 @@
+require "fileutils"
+require "tmpdir"
+require_relative "command_runner"
+require_relative "environment"
+
+# Namespace for operating-system command sandboxing.
+module Kward
+  module Sandbox
+    # Runs a command in a Bubblewrap mount namespace on Linux.
+    class LinuxBubblewrapRunner < CommandRunner
+      def self.executable
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).filter_map do |directory|
+          path = File.expand_path("bwrap", directory)
+          path if File.file?(path) && File.executable?(path)
+        end.first
+      end
+
+      def self.capabilities(platform: RUBY_PLATFORM, executable: self.executable)
+        available = platform.to_s.include?("linux") && !executable.to_s.empty?
+        return Capabilities.new(available: true, filesystem_enforced: true, child_network_enforced: true, backend: "linux_bubblewrap") if available
+
+        Capabilities.new(
+          available: false,
+          filesystem_enforced: false,
+          child_network_enforced: false,
+          backend: "linux_bubblewrap",
+          reason: "Bubblewrap is unavailable"
+        )
+      end
+
+      def initialize(policy:, executable: self.class.executable, capabilities: self.class.capabilities(executable: executable))
+        raise ArgumentError, "Linux Bubblewrap is unavailable: #{capabilities.reason}" unless capabilities.available?
+
+        super(policy:, capabilities:)
+        @executable = executable
+      end
+
+      def run(command, cwd:, timeout_seconds:, max_output_bytes:, cancellation: nil, &block)
+        temporary_root = Dir.mktmpdir("kward-sandbox")
+        environment = Environment.command_worker(temporary_root)
+
+        LocalCommandRunner.new(
+          timeout_seconds: timeout_seconds,
+          max_output_bytes: max_output_bytes
+        ).run(
+          *command_argv(command, cwd: cwd, temporary_root: temporary_root),
+          env: environment,
+          cwd: cwd,
+          cancellation: cancellation,
+          unsetenv_others: true,
+          &block
+        )
+      ensure
+        FileUtils.remove_entry(temporary_root) if temporary_root && File.exist?(temporary_root)
+      end
+
+      def command_argv(command, cwd:, temporary_root: nil)
+        temporary_root ||= Dir.tmpdir
+        workspace_root = policy.workspace_root
+        writable_roots = policy.command_writable_roots + [File.realpath(temporary_root)]
+        argv = [@executable, "--die-with-parent", "--new-session", "--ro-bind", "/", "/", "--dev", "/dev", "--proc", "/proc"]
+        argv << "--unshare-net" unless policy.child_network_allowed?
+        argv.concat(["--bind", workspace_root, workspace_root]) if policy.workspace_write?
+        writable_roots.reject { |path| path == workspace_root }.each { |path| argv.concat(["--bind", path, path]) }
+        argv.concat(["--ro-bind", File.join(workspace_root, ".git"), File.join(workspace_root, ".git")]) if policy.protect_git_metadata? && File.exist?(File.join(workspace_root, ".git"))
+        argv.concat(["--setenv", "TMPDIR", temporary_root, "--setenv", "TMP", temporary_root, "--setenv", "TEMP", temporary_root])
+        argv.concat(["--chdir", cwd.to_s, "--", "/bin/sh", "-lc", command.to_s])
+      end
+    end
+  end
+end