robot_lab 0.2.7 → 0.3.0

data/lib/robot_lab/script_tool.rb

@@ -2,7 +2,6 @@
 
 require 'open3'
 require 'shellwords'
-require 'timeout'
 
 module RobotLab
   # Factory module for wrapping AgentSkills scripts as RobotLab::Tool instances.
@@ -10,7 +9,18 @@ module RobotLab
   # Given a path to an executable shell script, produces a Tool that shells
   # out to the script and returns its combined stdout+stderr output.
   # Non-executable scripts return nil with a logged warning.
+  #
+  # Core has no sandboxing of its own: by default every script runs unconfined
+  # with no timeout. An extension gem (e.g. robot_lab-sandbox) can install a
+  # confinement strategy by setting {.executor} to an object responding to
+  # +call(cmd, capabilities:, skill_dir:)+; when set, ScriptTool.execute
+  # delegates to it instead of running the command directly.
   module ScriptTool
+    class << self
+      # @return [#call, nil] optional executor installed by an extension gem
+      attr_accessor :executor
+    end
+
     # Wrap a script file as a RobotLab::Tool.
     #
     # @param script_path [String, Pathname] path to the script file
@@ -19,6 +29,8 @@ module RobotLab
     # @param capabilities [Capabilities, nil] declared capabilities (from SKILL.md)
     # @param skill_dir [String, nil] skill bundle root (defaults to the script's dir)
     # @return [RobotLab::Tool, nil] nil if the script is not executable
+    # :reek:ControlParameter -- `capabilities || ...` and `skill_dir || ...` are nil-safe defaults, not behavior selection.
+    # :reek:TooManyStatements -- linear derive/validate/build factory; the closure needs every derived local.
     def self.from_path(script_path, capabilities: nil, skill_dir: nil)
       path = Pathname.new(script_path)
 
@@ -52,49 +64,18 @@ module RobotLab
       end
     end
 
-    # Run a command, optionally confined by the sandbox and a timeout.
+    # Run a command, delegating to the installed {.executor} if one is present.
     #
-    # When sandboxing is disabled (the default) this is the original, unconfined
-    # capture2e path with no timeout — behaviour is unchanged. When enabled, the
-    # command is wrapped by the sandbox strategy for the effective grant and
-    # bounded by the grant's timeout.
+    # With no executor installed (the default — core has no sandboxing), this
+    # is a plain, unconfined capture2e path with no timeout. An extension gem
+    # that sets {.executor} controls confinement and timeout behavior entirely.
     #
     # @return [String] combined stdout+stderr, or an error string on failure
     def self.execute(cmd, capabilities:, skill_dir:)
-      unless Sandbox.enabled?
-        output, status = Open3.capture2e(*cmd)
-        return format_result(output, status)
-      end
+      return executor.call(cmd, capabilities: capabilities, skill_dir: skill_dir) if executor
 
-      grant   = capabilities.intersect(Capabilities.ceiling)
-      sandbox = Sandbox.for(grant, skill_dir: skill_dir)
-      begin
-        output, status = run_with_timeout(sandbox.wrap(cmd), grant.timeout)
-        format_result(output, status)
-      ensure
-        sandbox.cleanup
-      end
-    end
-
-    # @return [Array(String, Process::Status|nil)] output and status (nil = timed out)
-    def self.run_with_timeout(cmd, timeout)
-      Open3.popen2e(*cmd, pgroup: true) do |stdin, out, wait|
-        stdin.close
-        output = +''
-        begin
-          Timeout.timeout(timeout) { output << out.read }
-        rescue Timeout::Error
-          terminate(wait.pid)
-          return ["#{output}\n[killed: exceeded #{timeout}s]", nil]
-        end
-        [output, wait.value]
-      end
-    end
-
-    def self.terminate(pid)
-      Process.kill('-TERM', Process.getpgid(pid))
-    rescue StandardError
-      nil
+      output, status = Open3.capture2e(*cmd)
+      format_result(output, status)
     end
 
     # @param status [Process::Status, nil] nil indicates a timeout kill

data/lib/robot_lab/state_proxy.rb

@@ -147,6 +147,7 @@ module RobotLab
 
     # Respond to method calls as hash access
     #
+    # :reek:BooleanParameter -- include_private is Ruby's respond_to_missing? contract signature.
     def respond_to_missing?(method_name, include_private = false)
       key = method_name.to_s.chomp("=").to_sym
       @data.key?(key) || super

data/lib/robot_lab/streaming/context.rb

@@ -36,6 +36,7 @@ module RobotLab
       # @param publish [Proc] callback for publishing events
       # @param parent_run_id [String, nil] parent run identifier
       # @param sequence_counter [SequenceCounter, nil] shared sequence counter
+      # :reek:ControlParameter -- `sequence_counter || SequenceCounter.new` is a nil-safe default.
       def initialize(run_id:, message_id:, scope:, publish:, parent_run_id: nil, sequence_counter: nil)
         @run_id = run_id
         @parent_run_id = parent_run_id

data/lib/robot_lab/streaming/events.rb

@@ -7,6 +7,7 @@ module RobotLab
     # Defines the structure and types of events emitted during
     # robot and network execution.
     #
+    # :reek:TooManyConstants -- deliberately a flat catalog of every streaming event name.
     module Events
       # Run lifecycle events
       RUN_STARTED = "run.started"

data/lib/robot_lab/task.rb

@@ -89,6 +89,7 @@ module RobotLab
 
     private
 
+    # :reek:TooManyStatements -- one guarded assignment per task-level override injected into run params.
     def enhanced_result(result)
       run_params = deep_merge(result.context[:run_params] || {}, @context)
       run_params[:mcp] = @mcp unless @mcp == :none
@@ -114,6 +115,7 @@ module RobotLab
     # @param override [Hash] the overriding hash
     # @return [Hash] the merged result
     #
+    # :reek:FeatureEnvy -- pure recursive hash merge of its two arguments; it has no useful self.
     def deep_merge(base, override)
       base = base.transform_keys(&:to_sym)
       override = override.transform_keys(&:to_sym)

data/lib/robot_lab/tool.rb

@@ -9,7 +9,7 @@ module RobotLab
   #
   #   class GetWeather < RobotLab::Tool
   #     description "Get weather for a location"
-  #     param :location, type: "string", desc: "City name"
+  #     parameter :location, type: "string", description: "City name"
   #
   #     def execute(location:)
   #       WeatherService.fetch(location)
@@ -27,6 +27,8 @@ module RobotLab
   # enabling tools that modify their robot's state (temperature,
   # system prompt, spawning, etc.).
   #
+  # :reek:InstanceVariableAssumption -- @custom_name/@mcp are set by Tool.create via instance_variable_set,
+  #   @raise_on_error/@ractor_safe are class-level DSL ivars; every read is defined?-guarded.
   class Tool < RubyLLM::Tool
     # @!attribute [rw] robot
     #   @return [Robot, nil] the robot that owns this tool
@@ -91,9 +93,11 @@ module RobotLab
     #
     # For non-Ractor-safe tools: runs execute directly in the calling thread.
     #
+    # @param tool_call [RubyLLM::ToolCall, nil] the originating tool call (supplied by the chat)
     # @param args [Hash] the tool arguments from the LLM
     # @return [Object] the tool result or an error string
-    def call(args)
+    # :reek:TooManyStatements -- hook-wrapped dispatch with per-error-class handling; the rescue clauses are the method.
+    def call(tool_call: nil, **args)
       context = ToolCallHookContext.new(tool: self, tool_args: args, robot: @robot)
 
       RobotLab::Hooks.run(:tool_call, context, **tool_hook_options) do
@@ -145,6 +149,7 @@ module RobotLab
     #     mcp: "brave_search"
     #   ) { |args| mcp_client.call_tool("search", args) }
     #
+    # :reek:TooManyStatements -- anonymous-class factory: DSL application and instance wiring form one linear build.
     def self.create(name:, description: nil, parameters: nil, mcp: nil, robot: nil, &handler)
       desc_text = description
       params_hash = parameters
@@ -153,15 +158,9 @@ module RobotLab
       tool_class = Class.new(self) do
         description(desc_text) if desc_text
 
-        if params_hash.is_a?(Hash) && params_hash[:properties]
-          required_list = Array(params_hash[:required]).map(&:to_s)
-          params_hash[:properties].each do |pname, pdef|
-            param pname.to_sym,
-                  type: pdef[:type] || "string",
-                  desc: pdef[:description],
-                  required: required_list.include?(pname.to_s)
-          end
-        end
+        # ruby_llm 2.0's parameters() accepts a raw JSON Schema hash, so the
+        # full schema (including nested items/objects) survives verbatim.
+        parameters(params_hash) if params_hash.is_a?(Hash) && params_hash[:properties]
 
         define_method(:execute) do |**args|
           block.call(args)
@@ -179,7 +178,7 @@ module RobotLab
     #
     # @return [Hash] JSON Schema representation
     def to_json_schema
-      schema = params_schema || { "type" => "object", "properties" => {}, "required" => [] }
+      schema = parameters_schema || { "type" => "object", "properties" => {}, "required" => [] }
       {
         name: name,
         description: description,

data/lib/robot_lab/user_message.rb

@@ -41,6 +41,7 @@ module RobotLab
     # @param system_prompt [String, nil] additional system prompt
     # @param metadata [Hash, nil] additional metadata
     # @param id [String, nil] unique identifier (defaults to UUID)
+    # :reek:ControlParameter -- `metadata || {}` and `id || SecureRandom.uuid` are nil-safe defaults.
     def initialize(content, session_id: nil, system_prompt: nil, metadata: nil, id: nil)
       @content = content.to_s
       @session_id = session_id

data/lib/robot_lab/utils.rb

@@ -13,6 +13,7 @@ module RobotLab
     # When already inside an Async reactor, creates a child task.
     # Otherwise, creates a temporary reactor that runs the block
     # and cleans up automatically.
+    # :reek:FeatureEnvy -- formatting the rescued exception for the log line; there is nothing else to reference.
     def dispatch_async(&block)
       Async do
         block.call
@@ -25,6 +26,7 @@ module RobotLab
     #
     # @param obj [Object] the object to duplicate
     # @return [Object] the deep copy
+    # :reek:FeatureEnvy -- pure recursive copy of its argument; it has no useful self.
     def deep_dup(obj)
       case obj
       when Hash

data/lib/robot_lab/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RobotLab
-  VERSION = "0.2.7"
+  VERSION = "0.3.0"
 end

data/lib/robot_lab/waiter.rb

@@ -28,6 +28,9 @@ module RobotLab
     # @param timeout [Numeric, nil] maximum seconds to wait (nil = indefinite)
     # @return [Object, :timeout] the signaled value, or :timeout if timed out
     #
+    # :reek:TooManyStatements -- register/block/drain steps of the wake-pipe protocol are one atomic unit.
+    # :reek:DuplicateMethodCall -- the synchronize blocks are deliberately separate: the lock must be released
+    #   around the blocking wait_readable.
     def wait(timeout: nil)
       @mutex.synchronize do
         return @value if @signaled

data/lib/robot_lab.rb

@@ -39,7 +39,7 @@ require 'typed_bus'
 #   # See lib/robot_lab/config/defaults.yml for all options
 #
 #   # Access configuration values:
-#   RobotLab.config.ruby_llm.model            #=> "claude-sonnet-4"
+#   RobotLab.config.ruby_llm.model            #=> "claude-sonnet-4-6"
 #   RobotLab.config.ruby_llm.request_timeout  #=> 120
 #
 module RobotLab
@@ -132,14 +132,15 @@ module RobotLab
     end
 
     def with_hook_scope(registries, per_run_hooks)
-      previous = Thread.current[:robot_lab_hook_scope]
-      Thread.current[:robot_lab_hook_scope] = {
+      thread = Thread.current
+      previous = thread[:robot_lab_hook_scope]
+      thread[:robot_lab_hook_scope] = {
         registries: registries,
         per_run_hooks: per_run_hooks
       }
       yield
     ensure
-      Thread.current[:robot_lab_hook_scope] = previous
+      thread[:robot_lab_hook_scope] = previous
     end
 
     def current_hook_scope
@@ -158,7 +159,7 @@ module RobotLab
     # @return [Config] the config instance
     #
     # @example
-    #   RobotLab.config.ruby_llm.model            #=> "claude-sonnet-4"
+    #   RobotLab.config.ruby_llm.model            #=> "claude-sonnet-4-6"
     #   RobotLab.config.ruby_llm.request_timeout  #=> 120
     #   RobotLab.config.development?              #=> true
     def config
@@ -172,7 +173,7 @@ module RobotLab
     #
     # @example
     #   RobotLab.configure do |c|
-    #     c.default_model = "claude-sonnet-4"
+    #     c.default_model = "claude-sonnet-4-6"
     #   end
     def configure
       yield config
@@ -233,6 +234,7 @@ module RobotLab
     #     name: "helper",
     #     system_prompt: "You are a helpful assistant."
     #   )
+    # :reek:LongParameterList :reek:BooleanParameter -- documented factory API mirroring Robot#initialize; enable_cache is a feature toggle.
     def build(name: "robot", template: nil, system_prompt: nil, context: {}, enable_cache: true, bus: nil, skills: nil,
               config: nil, **)
       Robot.new(
@@ -295,6 +297,7 @@ module RobotLab
     #
     # @example Memory with caching disabled
     #   memory = RobotLab.create_memory(data: {}, enable_cache: false)
+    # :reek:BooleanParameter -- enable_cache is a documented feature toggle forwarded to Memory.new.
     def create_memory(data: {}, enable_cache: true, **)
       Memory.new(data: data, enable_cache: enable_cache, **)
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: robot_lab
 version: !ruby/object:Gem::Version
-  version: 0.2.7
+  version: 0.3.0
 platform: ruby
 authors:
 - Dewayne VanHoozer
@@ -43,70 +43,56 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.12'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.12'
-- !ruby/object:Gem::Dependency
-  name: ruby_llm-mcp
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
-  name: prompt_manager
+  name: ruby_llm-providers-apfel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: 0.2.1
 - !ruby/object:Gem::Dependency
-  name: ruby_llm-schema
+  name: ruby_llm-providers-lms
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: 0.2.1
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.3'
+        version: 0.2.1
 - !ruby/object:Gem::Dependency
-  name: ruby_llm-semantic_cache
+  name: prompt_manager
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '0.1'
+        version: '1.0'
 - !ruby/object:Gem::Dependency
   name: async
   requirement: !ruby/object:Gem::Requirement
@@ -197,8 +183,9 @@ description: |
   memory; networks for coordinating multiple robots with intelligent routing; MCP (Model
   Context Protocol) integration for external tool servers; and a memory system with Redis
   backend and semantic caching. Optional gems add Rails integration (robot_lab-rails),
-  durable learning (robot_lab-durable), Ractor concurrency (robot_lab-ractor), and
-  document storage (robot_lab-document_store).
+  durable learning (robot_lab-durable), Ractor concurrency (robot_lab-ractor), document
+  storage (robot_lab-document_store), and OS-level skill-script confinement
+  (robot_lab-sandbox). Core itself imposes no execution limitations.
 email:
 - dvanhoozer@gmail.com
 executables: []
@@ -218,12 +205,14 @@ files:
 - ".loki"
 - ".quality/reek_baseline.txt"
 - ".rubocop.yml"
+- Archspec.rb
 - CHANGELOG.md
 - CLAUDE.md
 - COMMITS.md
 - LICENSE.txt
 - README.md
 - Rakefile
+- _typos.toml
 - agent2agent_review.md
 - agentf_improvements.md
 - agents.md
@@ -309,6 +298,7 @@ files:
 - examples/14_rusty_circuit/scout.rb
 - examples/14_rusty_circuit/show.log
 - examples/15_memory_network_and_bus/.envrc
+- examples/15_memory_network_and_bus/README.md
 - examples/15_memory_network_and_bus/editor_in_chief.rb
 - examples/15_memory_network_and_bus/editorial_pipeline.rb
 - examples/15_memory_network_and_bus/linux_writer.rb
@@ -321,6 +311,7 @@ files:
 - examples/15_memory_network_and_bus/output/memory.json
 - examples/15_memory_network_and_bus/output/revision_1.md
 - examples/15_memory_network_and_bus/output/revision_2.md
+- examples/15_memory_network_and_bus/output/revision_3.md
 - examples/15_memory_network_and_bus/output/windows_draft.md
 - examples/15_memory_network_and_bus/prompts/os_advocate.md
 - examples/15_memory_network_and_bus/prompts/os_chief.md
@@ -384,6 +375,7 @@ files:
 - examples/26_document_store/postgres_runbook.md
 - examples/26_document_store/redis_caching_guide.md
 - examples/26_document_store/sidekiq_guide.md
+- examples/27_incident_response/README.md
 - examples/27_incident_response/incident_response.rb
 - examples/28_mcp_discovery.rb
 - examples/29_ractor_tools.rb
@@ -445,6 +437,7 @@ files:
 - examples/prompts/template_with_skills_test.md
 - examples/prompts/triage.md
 - examples/ruboruby.md
+- examples/run_all.rb
 - examples/xyzzy.rb
 - lib/robot_lab.rb
 - lib/robot_lab/agent_skill.rb
@@ -487,14 +480,12 @@ files:
 - lib/robot_lab/robot/history_search.rb
 - lib/robot_lab/robot/hooking.rb
 - lib/robot_lab/robot/mcp_management.rb
+- lib/robot_lab/robot/result_building.rb
 - lib/robot_lab/robot/template_rendering.rb
 - lib/robot_lab/robot_message.rb
 - lib/robot_lab/robot_result.rb
 - lib/robot_lab/run_config.rb
 - lib/robot_lab/runnable.rb
-- lib/robot_lab/sandbox.rb
-- lib/robot_lab/sandbox/null.rb
-- lib/robot_lab/sandbox/seatbelt.rb
 - lib/robot_lab/script_tool.rb
 - lib/robot_lab/state_proxy.rb
 - lib/robot_lab/streaming/context.rb
@@ -541,7 +532,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.19
+rubygems_version: 4.0.21
 specification_version: 4
 summary: Ruby framework for building and orchestrating multi-robot LLM workflows
 test_files: []

data/lib/robot_lab/sandbox/null.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module RobotLab
-  module Sandbox
-    # Passthrough strategy: runs the command with no confinement. Used when
-    # sandboxing is unavailable (non-macOS) or unnecessary (trust: core).
-    class Null
-      def wrap(cmd) = cmd
-
-      def cleanup; end
-    end
-  end
-end

data/lib/robot_lab/sandbox/seatbelt.rb

@@ -1,104 +0,0 @@
-# frozen_string_literal: true
-
-require "tempfile"
-
-module RobotLab
-  module Sandbox
-    # macOS strategy: generates a deny-by-default sandbox-exec profile from the
-    # effective grant and wraps the command as
-    #   sandbox-exec -f <profile> <cmd...>
-    #
-    # The profile allows process exec plus reads of system locations (so the
-    # interpreter can load), reads of the skill bundle and granted paths, writes
-    # only to granted paths (and the standard /dev sinks), and network only when
-    # granted. Everything else -- notably $HOME, so SSH/cloud credentials --
-    # is denied. Interpreters installed under $HOME (e.g. rbenv) are not visible;
-    # declare them in fs_read or mark the skill trust: core.
-    class Seatbelt
-      # System locations a typical interpreter needs to read to start up.
-      SYSTEM_READ = %w[/usr /bin /sbin /System /Library /opt /private/etc /dev /var/select].freeze
-      DEV_WRITE   = %w[/dev/null /dev/stdout /dev/stderr /dev/dtracehelper /dev/tty].freeze
-
-      def initialize(grant, skill_dir:)
-        @grant     = grant
-        @skill_dir = File.expand_path(skill_dir.to_s)
-        @profile   = nil
-      end
-
-      def wrap(cmd)
-        @profile = write_profile
-        ["sandbox-exec", "-f", @profile, *cmd]
-      end
-
-      def cleanup
-        File.unlink(@profile) if @profile && File.exist?(@profile)
-      rescue StandardError
-        nil
-      end
-
-      # The generated Seatbelt profile text (public for testing).
-      def profile_text
-        reads  = canonicalize(SYSTEM_READ + [@skill_dir] + @grant.fs_read)
-        writes = canonicalize(@grant.fs_write)
-        lines = [
-          "(version 1)",
-          # bsd.sb supplies the base rules a process needs to start (dyld, mach
-          # bootstrap, etc.); without it a deny-default profile aborts the binary.
-          '(import "bsd.sb")',
-          "(deny default)",
-          "(allow process-fork)",
-          "(allow process-exec)",
-          "(allow sysctl-read)",
-          "(allow mach-lookup)",
-          # Metadata (stat/lookup) on any path so the interpreter can traverse to
-          # granted files; reading file *contents* stays restricted below.
-          "(allow file-read-metadata)",
-          read_rule(reads),
-          write_rule(DEV_WRITE.map { |p| [:literal, p] } + writes.map { |p| [:subpath, p] })
-        ]
-        lines << "(allow network*)" if @grant.network
-        "#{lines.compact.join("\n")}\n"
-      end
-
-      private
-
-      def write_profile
-        file = Tempfile.create(["robot_lab-sandbox-", ".sb"])
-        file.write(profile_text)
-        file.close
-        file.path
-      end
-
-      # Resolve to the real (symlink-free) path the kernel matches against. macOS
-      # symlinks /tmp -> /private/tmp, /var -> /private/var, etc., so logical
-      # paths would never match. For not-yet-existing write targets, resolve the
-      # nearest existing ancestor and re-append the remainder.
-      def canonicalize(paths)
-        Array(paths).map { |p| real_path(File.expand_path(p.to_s)) }.compact.uniq
-      end
-
-      def real_path(expanded)
-        existing = expanded
-        rest     = []
-        until File.exist?(existing) || existing == "/"
-          rest.unshift(File.basename(existing))
-          existing = File.dirname(existing)
-        end
-        real = File.realpath(existing)
-        rest.empty? ? real : File.join(real, *rest)
-      rescue StandardError
-        expanded
-      end
-
-      def read_rule(paths)
-        subpaths = paths.map { |p| "(subpath #{p.inspect})" }.join(" ")
-        "(allow file-read* #{subpaths})"
-      end
-
-      def write_rule(entries)
-        clauses = entries.map { |kind, p| "(#{kind} #{p.inspect})" }.join(" ")
-        "(allow file-write* #{clauses})"
-      end
-    end
-  end
-end

data/lib/robot_lab/sandbox.rb

@@ -1,52 +0,0 @@
-# frozen_string_literal: true
-
-module RobotLab
-  # Confines skill-script execution to a granted set of capabilities.
-  #
-  # Sandboxing is opt-in (config.sandbox.enabled). When off, every script runs
-  # unconfined exactly as before. When on, each script runs under a strategy:
-  #
-  # - {Sandbox::Seatbelt} on macOS — a generated deny-by-default sandbox-exec
-  #   profile derived from the effective {Capabilities} grant.
-  # - {Sandbox::Null} elsewhere (or for +trust: core+ skills) — a passthrough.
-  #
-  # OS-level confinement is therefore best-effort and platform-specific; it is
-  # never a hard dependency.
-  module Sandbox
-    module_function
-
-    # @return [Boolean] whether sandboxing is turned on in config
-    def enabled?(config = RobotLab.config)
-      config.respond_to?(:sandbox) && config.sandbox && config.sandbox.enabled == true
-    end
-
-    def macos?
-      RUBY_PLATFORM.include?("darwin")
-    end
-
-    # Pick a strategy for the given (already-intersected) grant.
-    #
-    # @param grant [Capabilities] effective grant
-    # @param skill_dir [String] skill bundle root, always granted read access
-    # @param macos [Boolean] whether to use the macOS strategy; defaults to the
-    #   real platform check and is injectable so both branches are testable on
-    #   any host without stubbing.
-    # @return [#wrap, #cleanup]
-    def for(grant, skill_dir:, macos: macos?)
-      return Null.new if grant.core?
-      return Seatbelt.new(grant, skill_dir: skill_dir) if macos
-
-      warn_once_non_macos
-      Null.new
-    end
-
-    def warn_once_non_macos
-      return if @warned_non_macos
-
-      @warned_non_macos = true
-      RobotLab.config.logger.warn(
-        "Sandbox: OS-level confinement is only available on macOS; scripts run unconfined here"
-      )
-    end
-  end
-end