@agenshield/interceptor 0.6.1 → 0.7.0

package/register.js

@@ -34,9 +34,14 @@ function createConfig(overrides) {
     interceptFetch: env["AGENSHIELD_INTERCEPT_FETCH"] !== "false",
     interceptHttp: env["AGENSHIELD_INTERCEPT_HTTP"] !== "false",
     interceptWs: env["AGENSHIELD_INTERCEPT_WS"] !== "false",
-    interceptFs: env["AGENSHIELD_INTERCEPT_FS"] !== "false",
+    interceptFs: false,
     interceptExec: env["AGENSHIELD_INTERCEPT_EXEC"] !== "false",
-    timeout: parseInt(env["AGENSHIELD_TIMEOUT"] || "30000", 10),
+    timeout: parseInt(env["AGENSHIELD_TIMEOUT"] || "5000", 10),
+    contextType: env["AGENSHIELD_CONTEXT_TYPE"] || "agent",
+    contextSkillSlug: env["AGENSHIELD_SKILL_SLUG"],
+    contextAgentId: env["AGENSHIELD_AGENT_ID"],
+    enableSeatbelt: env["AGENSHIELD_SEATBELT"] !== "false" && process.platform === "darwin",
+    seatbeltProfileDir: env["AGENSHIELD_SEATBELT_DIR"] || "/tmp/agenshield-profiles",
     ...overrides
   };
 }
@@ -80,13 +85,34 @@ var TimeoutError = class extends AgenShieldError {
 // libs/shield-interceptor/src/debug-log.ts
 var fs = __toESM(require("node:fs"), 1);
 var _appendFileSync = fs.appendFileSync.bind(fs);
+var _writeSync = fs.writeSync.bind(fs);
 var LOG_PATH = "/var/log/agenshield/interceptor.log";
+var FALLBACK_LOG_PATH = "/tmp/agenshield-interceptor.log";
+var resolvedLogPath = null;
+function getLogPath() {
+  if (resolvedLogPath !== null) return resolvedLogPath;
+  try {
+    _appendFileSync(LOG_PATH, "");
+    resolvedLogPath = LOG_PATH;
+  } catch {
+    resolvedLogPath = FALLBACK_LOG_PATH;
+  }
+  return resolvedLogPath;
+}
 function debugLog(msg) {
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] [pid:${process.pid}] ${msg}
+`;
   try {
-    _appendFileSync(LOG_PATH, `[${(/* @__PURE__ */ new Date()).toISOString()}] [pid:${process.pid}] ${msg}
-`);
+    _appendFileSync(getLogPath(), line);
   } catch {
   }
+  if (process.env["AGENSHIELD_LOG_LEVEL"] === "debug") {
+    try {
+      _writeSync(2, `[AgenShield:debug] ${msg}
+`);
+    } catch {
+    }
+  }
 }
 
 // libs/shield-interceptor/src/interceptors/base.ts
@@ -96,6 +122,7 @@ var BaseInterceptor = class {
   eventReporter;
   failOpen;
   installed = false;
+  interceptorConfig;
   brokerHttpPort;
   constructor(options) {
     this.client = options.client;
@@ -103,6 +130,7 @@ var BaseInterceptor = class {
     this.eventReporter = options.eventReporter;
     this.failOpen = options.failOpen;
     this.brokerHttpPort = options.brokerHttpPort ?? 5201;
+    this.interceptorConfig = options.config;
   }
   /**
    * Check if a URL targets the broker or daemon (should not be intercepted)
@@ -127,15 +155,28 @@ var BaseInterceptor = class {
   isInstalled() {
     return this.installed;
   }
+  /**
+   * Build execution context from config
+   */
+  getBasePolicyExecutionContext() {
+    const config = this.interceptorConfig;
+    if (!config) return void 0;
+    return {
+      callerType: config.contextType || "agent",
+      skillSlug: config.contextSkillSlug,
+      agentId: config.contextAgentId,
+      depth: 0
+    };
+  }
   /**
    * Check policy and handle the result
    */
-  async checkPolicy(operation, target) {
+  async checkPolicy(operation, target, context) {
     const startTime = Date.now();
     debugLog(`base.checkPolicy START op=${operation} target=${target}`);
     try {
       this.eventReporter.intercept(operation, target);
-      const result = await this.policyEvaluator.check(operation, target);
+      const result = await this.policyEvaluator.check(operation, target, context);
       debugLog(`base.checkPolicy evaluator result op=${operation} target=${target} allowed=${result.allowed} policyId=${result.policyId}`);
       if (!result.allowed) {
         this.eventReporter.deny(operation, target, result.policyId, result.reason);
@@ -182,6 +223,19 @@ var FetchInterceptor = class extends BaseInterceptor {
   constructor(options) {
     super(options);
   }
+  /**
+   * Build execution context from config
+   */
+  getPolicyExecutionContext() {
+    const config = this.interceptorConfig;
+    if (!config) return void 0;
+    return {
+      callerType: config.contextType || "agent",
+      skillSlug: config.contextSkillSlug,
+      agentId: config.contextAgentId,
+      depth: 0
+    };
+  }
   install() {
     if (this.installed) return;
     this.originalFetch = globalThis.fetch;
@@ -212,48 +266,10 @@ var FetchInterceptor = class extends BaseInterceptor {
       return this.originalFetch(input, init);
     }
     debugLog(`fetch checkPolicy START url=${url}`);
-    await this.checkPolicy("http_request", url);
-    debugLog(`fetch checkPolicy DONE url=${url}`);
     try {
-      const method = init?.method || "GET";
-      const headers = {};
-      if (init?.headers) {
-        if (init.headers instanceof Headers) {
-          init.headers.forEach((value, key) => {
-            headers[key] = value;
-          });
-        } else if (Array.isArray(init.headers)) {
-          for (const [key, value] of init.headers) {
-            headers[key] = value;
-          }
-        } else {
-          Object.assign(headers, init.headers);
-        }
-      }
-      let body;
-      if (init?.body) {
-        if (typeof init.body === "string") {
-          body = init.body;
-        } else if (init.body instanceof ArrayBuffer) {
-          body = Buffer.from(init.body).toString("base64");
-        } else {
-          body = String(init.body);
-        }
-      }
-      const result = await this.client.request("http_request", {
-        url,
-        method,
-        headers,
-        body
-      });
-      const responseHeaders = new Headers(result.headers);
-      return new Response(result.body, {
-        status: result.status,
-        statusText: result.statusText,
-        headers: responseHeaders
-      });
+      await this.checkPolicy("http_request", url, this.getPolicyExecutionContext());
+      debugLog(`fetch checkPolicy DONE url=${url}`);
     } catch (error) {
-      debugLog(`fetch ERROR url=${url} error=${error.message}`);
       if (error.name === "PolicyDeniedError") {
         throw error;
       }
@@ -263,6 +279,7 @@ var FetchInterceptor = class extends BaseInterceptor {
       }
       throw error;
     }
+    return this.originalFetch(input, init);
   }
 };
 
@@ -407,6 +424,8 @@ var import_node_crypto = require("node:crypto");
 var _existsSync = fs2.existsSync.bind(fs2);
 var _readFileSync = fs2.readFileSync.bind(fs2);
 var _unlinkSync = fs2.unlinkSync.bind(fs2);
+var _readdirSync = fs2.readdirSync.bind(fs2);
+var _statSync = fs2.statSync.bind(fs2);
 var _spawnSync = import_node_child_process.spawnSync;
 var _execSync = import_node_child_process.execSync;
 var SyncClient = class {
@@ -414,22 +433,59 @@ var SyncClient = class {
   httpHost;
   httpPort;
   timeout;
+  socketFailCount = 0;
+  socketSkipUntil = 0;
   constructor(options) {
     this.socketPath = options.socketPath;
     this.httpHost = options.httpHost;
     this.httpPort = options.httpPort;
     this.timeout = options.timeout;
+    this.cleanupStaleTmpFiles();
+  }
+  /**
+   * Remove stale /tmp/agenshield-sync-*.json files from previous runs
+   */
+  cleanupStaleTmpFiles() {
+    try {
+      const tmpDir = "/tmp";
+      const files = _readdirSync(tmpDir);
+      const cutoff = Date.now() - 5 * 60 * 1e3;
+      for (const f of files) {
+        if (f.startsWith("agenshield-sync-") && f.endsWith(".json")) {
+          const fp = `${tmpDir}/${f}`;
+          try {
+            const stat = _statSync(fp);
+            if (stat.mtimeMs < cutoff) _unlinkSync(fp);
+          } catch {
+          }
+        }
+      }
+    } catch {
+    }
   }
   /**
    * Send a synchronous request to the broker
    */
   request(method, params) {
     debugLog(`syncClient.request START method=${method}`);
+    const now = Date.now();
+    if (now < this.socketSkipUntil) {
+      debugLog(`syncClient.request SKIP socket (circuit open for ${this.socketSkipUntil - now}ms), using HTTP`);
+      const result = this.httpRequestSync(method, params);
+      debugLog(`syncClient.request http OK method=${method}`);
+      return result;
+    }
     try {
       const result = this.socketRequestSync(method, params);
+      this.socketFailCount = 0;
       debugLog(`syncClient.request socket OK method=${method}`);
       return result;
     } catch (socketErr) {
+      this.socketFailCount++;
+      if (this.socketFailCount >= 2) {
+        this.socketSkipUntil = Date.now() + 6e4;
+        debugLog(`syncClient.request socket circuit OPEN (${this.socketFailCount} failures)`);
+      }
       debugLog(`syncClient.request socket FAILED: ${socketErr.message}, trying HTTP`);
       const result = this.httpRequestSync(method, params);
       debugLog(`syncClient.request http OK method=${method}`);
@@ -454,29 +510,40 @@ var SyncClient = class {
       const net = require('net');
       const fs = require('fs');
 
+      let done = false;
       const socket = net.createConnection('${this.socketPath}');
       let data = '';
 
+      const timer = setTimeout(() => {
+        if (done) return;
+        done = true;
+        socket.destroy();
+        fs.writeFileSync('${tmpFile}', JSON.stringify({ error: 'timeout' }));
+        process.exit(1);
+      }, ${this.timeout});
+
       socket.on('connect', () => {
         socket.write(${JSON.stringify(request)});
       });
 
       socket.on('data', (chunk) => {
         data += chunk.toString();
-        if (data.includes('\\n')) {
+        if (data.includes('\\n') && !done) {
+          done = true;
+          clearTimeout(timer);
           socket.end();
           fs.writeFileSync('${tmpFile}', data.split('\\n')[0]);
+          process.exit(0);
         }
       });
 
       socket.on('error', (err) => {
+        if (done) return;
+        done = true;
+        clearTimeout(timer);
         fs.writeFileSync('${tmpFile}', JSON.stringify({ error: err.message }));
+        process.exit(1);
       });
-
-      setTimeout(() => {
-        socket.destroy();
-        fs.writeFileSync('${tmpFile}', JSON.stringify({ error: 'timeout' }));
-      }, ${this.timeout});
     `;
     try {
       debugLog(`syncClient.socketRequestSync _spawnSync START node-bin method=${method}`);
@@ -553,11 +620,227 @@ var SyncClient = class {
   }
 };
 
+// libs/shield-interceptor/src/seatbelt/profile-manager.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var crypto = __toESM(require("node:crypto"), 1);
+var path = __toESM(require("node:path"), 1);
+var _mkdirSync = fs3.mkdirSync.bind(fs3);
+var _writeFileSync = fs3.writeFileSync.bind(fs3);
+var _existsSync2 = fs3.existsSync.bind(fs3);
+var _readFileSync2 = fs3.readFileSync.bind(fs3);
+var _readdirSync2 = fs3.readdirSync.bind(fs3);
+var _statSync2 = fs3.statSync.bind(fs3);
+var _unlinkSync2 = fs3.unlinkSync.bind(fs3);
+var _chmodSync = fs3.chmodSync.bind(fs3);
+var ProfileManager = class {
+  profileDir;
+  ensuredDir = false;
+  constructor(profileDir) {
+    this.profileDir = profileDir;
+  }
+  /**
+   * Get or create a profile file on disk. Returns the absolute path.
+   * Uses content-hash naming so identical configs reuse the same file.
+   */
+  getOrCreateProfile(content) {
+    this.ensureDir();
+    const hash = crypto.createHash("sha256").update(content).digest("hex").slice(0, 16);
+    const profilePath = path.join(this.profileDir, `sb-${hash}.sb`);
+    if (!_existsSync2(profilePath)) {
+      debugLog(`profile-manager: writing new profile ${profilePath} (${content.length} bytes)`);
+      _writeFileSync(profilePath, content, { mode: 420 });
+    }
+    return profilePath;
+  }
+  /**
+   * Generate an SBPL profile from a SandboxConfig.
+   */
+  generateProfile(sandbox) {
+    if (sandbox.profileContent) {
+      return sandbox.profileContent;
+    }
+    const lines = [
+      ";; AgenShield dynamic seatbelt profile",
+      `;; Generated: ${(/* @__PURE__ */ new Date()).toISOString()}`,
+      "(version 1)",
+      "(deny default)",
+      ""
+    ];
+    lines.push(
+      ";; Filesystem: reads allowed, writes restricted",
+      "(allow file-read*)",
+      ""
+    );
+    const writePaths = ["/tmp", "/private/tmp", "/var/folders"];
+    if (sandbox.allowedWritePaths.length > 0) {
+      writePaths.push(...sandbox.allowedWritePaths);
+    }
+    lines.push("(allow file-write*");
+    for (const p of writePaths) {
+      lines.push(`  (subpath "${this.escapeSbpl(p)}")`);
+    }
+    lines.push(")");
+    lines.push("");
+    lines.push("(allow file-write*");
+    lines.push('  (literal "/dev/null")');
+    lines.push('  (literal "/dev/zero")');
+    lines.push('  (literal "/dev/random")');
+    lines.push('  (literal "/dev/urandom")');
+    lines.push(")");
+    lines.push("");
+    if (sandbox.deniedPaths.length > 0) {
+      lines.push(";; Denied paths");
+      for (const p of sandbox.deniedPaths) {
+        lines.push(`(deny file-read* file-write* (subpath "${this.escapeSbpl(p)}"))`);
+      }
+      lines.push("");
+    }
+    lines.push(";; Binary execution (system directories allowed as subpaths)");
+    lines.push("(allow process-exec");
+    lines.push('  (subpath "/bin")');
+    lines.push('  (subpath "/sbin")');
+    lines.push('  (subpath "/usr/bin")');
+    lines.push('  (subpath "/usr/sbin")');
+    lines.push('  (subpath "/usr/local/bin")');
+    lines.push('  (subpath "/opt/agenshield/bin")');
+    const coveredSubpaths = ["/bin/", "/sbin/", "/usr/bin/", "/usr/sbin/", "/usr/local/bin/", "/opt/agenshield/bin/"];
+    const home = process.env["HOME"];
+    if (home) {
+      lines.push(`  (subpath "${this.escapeSbpl(home)}/bin")`);
+      lines.push(`  (subpath "${this.escapeSbpl(home)}/homebrew")`);
+      coveredSubpaths.push(`${home}/bin/`, `${home}/homebrew/`);
+    }
+    const nvmDir = process.env["NVM_DIR"] || (home ? `${home}/.nvm` : null);
+    if (nvmDir) {
+      lines.push(`  (subpath "${this.escapeSbpl(nvmDir)}")`);
+      coveredSubpaths.push(`${nvmDir}/`);
+    }
+    const brewPrefix = process.env["HOMEBREW_PREFIX"];
+    if (brewPrefix && (!home || !brewPrefix.startsWith(home))) {
+      lines.push(`  (subpath "${this.escapeSbpl(brewPrefix)}/bin")`);
+      lines.push(`  (subpath "${this.escapeSbpl(brewPrefix)}/lib")`);
+      coveredSubpaths.push(`${brewPrefix}/bin/`, `${brewPrefix}/lib/`);
+    }
+    const uniqueBinaries = [...new Set(sandbox.allowedBinaries)];
+    for (const bin of uniqueBinaries) {
+      if (coveredSubpaths.some((dir) => bin === dir || bin.startsWith(dir))) continue;
+      if (bin.endsWith("/")) {
+        lines.push(`  (subpath "${this.escapeSbpl(bin)}")`);
+      } else {
+        lines.push(`  (literal "${this.escapeSbpl(bin)}")`);
+      }
+    }
+    lines.push(")");
+    lines.push("");
+    const uniqueDenied = [...new Set(sandbox.deniedBinaries)];
+    if (uniqueDenied.length > 0) {
+      lines.push(";; Denied binaries");
+      for (const bin of uniqueDenied) {
+        lines.push(`(deny process-exec (literal "${this.escapeSbpl(bin)}"))`);
+      }
+      lines.push("");
+    }
+    lines.push(";; Network");
+    if (sandbox.networkAllowed) {
+      if (sandbox.allowedHosts.length > 0 || sandbox.allowedPorts.length > 0) {
+        lines.push(";; Allow specific network targets");
+        for (const host of sandbox.allowedHosts) {
+          lines.push(`(allow network-outbound (remote tcp "${this.escapeSbpl(host)}:*"))`);
+        }
+        for (const port of sandbox.allowedPorts) {
+          lines.push(`(allow network-outbound (remote tcp "*:${port}"))`);
+        }
+        const isLocalhostOnly = sandbox.allowedHosts.length > 0 && sandbox.allowedHosts.every((h) => h === "localhost" || h === "127.0.0.1");
+        if (!isLocalhostOnly) {
+          lines.push('(allow network-outbound (remote udp "*:53") (remote tcp "*:53"))');
+        }
+      } else {
+        lines.push("(allow network*)");
+      }
+    } else {
+      lines.push("(deny network*)");
+    }
+    lines.push("");
+    lines.push(
+      ";; Broker / local unix sockets",
+      "(allow network-outbound (remote unix))",
+      "(allow network-inbound (local unix))",
+      "(allow file-read* file-write*",
+      '  (subpath "/var/run/agenshield")',
+      '  (subpath "/private/var/run/agenshield"))',
+      ""
+    );
+    lines.push(
+      ";; Process management",
+      "(allow process-fork)",
+      "(allow signal (target self))",
+      "(allow sysctl-read)",
+      ""
+    );
+    lines.push(
+      ";; Mach IPC",
+      "(allow mach-lookup)",
+      ""
+    );
+    return lines.join("\n");
+  }
+  /**
+   * Remove stale profile files older than maxAgeMs.
+   */
+  cleanup(maxAgeMs) {
+    if (!_existsSync2(this.profileDir)) return;
+    try {
+      const now = Date.now();
+      const entries = _readdirSync2(this.profileDir);
+      for (const entry of entries) {
+        if (!entry.endsWith(".sb")) continue;
+        const filePath = path.join(this.profileDir, entry);
+        try {
+          const stat = _statSync2(filePath);
+          if (now - stat.mtimeMs > maxAgeMs) {
+            _unlinkSync2(filePath);
+            debugLog(`profile-manager: cleaned up stale profile ${filePath}`);
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  /**
+   * Escape a string for safe inclusion in SBPL
+   */
+  escapeSbpl(s) {
+    return s.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+  }
+  /**
+   * Ensure the profile directory exists
+   */
+  ensureDir() {
+    if (this.ensuredDir) return;
+    if (!_existsSync2(this.profileDir)) {
+      _mkdirSync(this.profileDir, { recursive: true, mode: 1023 });
+    } else {
+      try {
+        const stat = _statSync2(this.profileDir);
+        if ((stat.mode & 511) !== 511) {
+          _chmodSync(this.profileDir, 1023);
+        }
+      } catch {
+      }
+    }
+    this.ensuredDir = true;
+  }
+};
+
 // libs/shield-interceptor/src/interceptors/child-process.ts
 var childProcessModule = require("node:child_process");
 var ChildProcessInterceptor = class extends BaseInterceptor {
   syncClient;
   _checking = false;
+  _executing = false;
+  // Guards exec→execFile re-entrancy
+  profileManager = null;
   originalExec = null;
   originalExecSync = null;
   originalSpawn = null;
@@ -566,13 +849,18 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
   originalFork = null;
   constructor(options) {
     super(options);
+    const config = this.interceptorConfig;
     this.syncClient = new SyncClient({
-      socketPath: "/var/run/agenshield/agenshield.sock",
-      httpHost: "localhost",
-      httpPort: 5201,
-      // Broker uses 5201
-      timeout: 3e4
+      socketPath: config?.socketPath || "/var/run/agenshield/agenshield.sock",
+      httpHost: config?.httpHost || "localhost",
+      httpPort: config?.httpPort || 5201,
+      timeout: config?.timeout || 3e4
     });
+    if (config?.enableSeatbelt && process.platform === "darwin") {
+      this.profileManager = new ProfileManager(
+        config.seatbeltProfileDir || "/tmp/agenshield-profiles"
+      );
+    }
   }
   install() {
     if (this.installed) return;
@@ -606,64 +894,207 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     this.originalFork = null;
     this.installed = false;
   }
+  /**
+   * Build execution context from config for RPC calls
+   */
+  getPolicyExecutionContext() {
+    const config = this.interceptorConfig;
+    return {
+      callerType: config?.contextType || "agent",
+      skillSlug: config?.contextSkillSlug,
+      agentId: config?.contextAgentId,
+      depth: 0
+    };
+  }
+  /**
+   * Synchronous policy check via SyncClient.
+   * Returns the full policy result (with sandbox config) or null if broker
+   * is unavailable and failOpen is true.
+   */
+  syncPolicyCheck(fullCommand) {
+    this._checking = true;
+    try {
+      debugLog(`cp.syncPolicyCheck START command=${fullCommand}`);
+      const context = this.getPolicyExecutionContext();
+      const result = this.syncClient.request(
+        "policy_check",
+        { operation: "exec", target: fullCommand, context }
+      );
+      debugLog(`cp.syncPolicyCheck DONE allowed=${result.allowed} command=${fullCommand}`);
+      if (!result.allowed) {
+        throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
+          operation: "exec",
+          target: fullCommand,
+          policyId: result.policyId
+        });
+      }
+      return result;
+    } catch (error) {
+      if (error instanceof PolicyDeniedError) {
+        throw error;
+      }
+      debugLog(`cp.syncPolicyCheck ERROR: ${error.message} command=${fullCommand}`);
+      if (!this.failOpen) {
+        throw error;
+      }
+      return null;
+    } finally {
+      this._checking = false;
+    }
+  }
+  /**
+   * Create a restrictive default sandbox config for fail-open scenarios.
+   * No network, minimal fs — better than running completely unsandboxed.
+   */
+  getFailOpenSandbox() {
+    return {
+      enabled: true,
+      allowedReadPaths: [],
+      allowedWritePaths: [],
+      deniedPaths: [],
+      networkAllowed: false,
+      allowedHosts: [],
+      allowedPorts: [],
+      allowedBinaries: [],
+      deniedBinaries: [],
+      envInjection: {},
+      envDeny: []
+    };
+  }
+  /**
+   * Resolve the sandbox config to use: from policy result, fail-open default, or null.
+   */
+  resolveSandbox(policyResult) {
+    if (policyResult?.sandbox?.enabled) {
+      return policyResult.sandbox;
+    }
+    if (policyResult === null && this.profileManager) {
+      return this.getFailOpenSandbox();
+    }
+    return null;
+  }
+  /**
+   * Wrap a command with sandbox-exec if seatbelt is enabled and sandbox config is present.
+   * Returns modified { command, args, options } for spawn-style calls.
+   */
+  wrapWithSeatbelt(command, args, options, policyResult) {
+    const sandbox = this.resolveSandbox(policyResult);
+    if (!this.profileManager || !sandbox || process.platform !== "darwin") {
+      return { command, args, options };
+    }
+    if (command === "/opt/agenshield/bin/node-bin" || command.endsWith("/node-bin")) {
+      debugLog(`cp.wrapWithSeatbelt: SKIP node-bin (already intercepted) command=${command}`);
+      return { command, args, options };
+    }
+    if (command === "/usr/bin/sandbox-exec" || command.endsWith("/sandbox-exec")) {
+      debugLog(`cp.wrapWithSeatbelt: SKIP already sandbox-exec command=${command}`);
+      return { command, args, options };
+    }
+    debugLog(`cp.wrapWithSeatbelt: wrapping command=${command}`);
+    const profileContent = this.profileManager.generateProfile(sandbox);
+    const profilePath = this.profileManager.getOrCreateProfile(profileContent);
+    const env = { ...options?.env || process.env };
+    if (sandbox.envInjection) {
+      Object.assign(env, sandbox.envInjection);
+    }
+    if (sandbox.envDeny) {
+      for (const key of sandbox.envDeny) {
+        delete env[key];
+      }
+    }
+    return {
+      command: "/usr/bin/sandbox-exec",
+      args: ["-f", profilePath, command, ...args],
+      options: { ...options, env }
+    };
+  }
+  /**
+   * Wrap a shell command string with sandbox-exec.
+   * For exec/execSync which take a full command string.
+   */
+  wrapCommandStringWithSeatbelt(command, options, policyResult) {
+    const sandbox = this.resolveSandbox(policyResult);
+    if (!this.profileManager || !sandbox || process.platform !== "darwin") {
+      return { command, options };
+    }
+    if (command.startsWith("/usr/bin/sandbox-exec ") || command.startsWith("sandbox-exec ")) {
+      debugLog(`cp.wrapCommandStringWithSeatbelt: SKIP already sandbox-exec command=${command}`);
+      return { command, options };
+    }
+    debugLog(`cp.wrapCommandStringWithSeatbelt: wrapping command=${command}`);
+    const profileContent = this.profileManager.generateProfile(sandbox);
+    const profilePath = this.profileManager.getOrCreateProfile(profileContent);
+    const env = { ...options?.env || process.env };
+    if (sandbox.envInjection) {
+      Object.assign(env, sandbox.envInjection);
+    }
+    if (sandbox.envDeny) {
+      for (const key of sandbox.envDeny) {
+        delete env[key];
+      }
+    }
+    return {
+      command: `/usr/bin/sandbox-exec -f ${profilePath} ${command}`,
+      options: { ...options, env }
+    };
+  }
   createInterceptedExec() {
     const self = this;
     const original = this.originalExec;
     return function interceptedExec(command, ...args) {
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
-      debugLog(`cp.exec ENTER command=${command} _checking=${self._checking}`);
-      if (self._checking) {
+      const options = args[0];
+      debugLog(`cp.exec ENTER command=${command} _checking=${self._checking} _executing=${self._executing}`);
+      if (self._checking || self._executing) {
         debugLog(`cp.exec SKIP (re-entrancy) command=${command}`);
         return original(command, ...args, callback);
       }
       self.eventReporter.intercept("exec", command);
-      self.checkPolicy("exec", command).then(() => {
-        original(command, ...args, callback);
-      }).catch((error) => {
+      let policyResult = null;
+      try {
+        policyResult = self.syncPolicyCheck(command);
+      } catch (error) {
         if (callback) {
-          callback(error, "", "");
+          process.nextTick(() => callback(error, "", ""));
         }
-      });
-      return original('echo ""');
+        return original('echo ""');
+      }
+      const wrapped = self.wrapCommandStringWithSeatbelt(command, options, policyResult);
+      debugLog(`cp.exec calling original command=${wrapped.command}`);
+      self._executing = true;
+      try {
+        if (wrapped.options) {
+          return original(wrapped.command, wrapped.options, callback);
+        }
+        return original(wrapped.command, callback);
+      } finally {
+        self._executing = false;
+      }
     };
   }
   createInterceptedExecSync() {
     const self = this;
     const original = this.originalExecSync;
     const interceptedExecSync = function(command, options) {
-      debugLog(`cp.execSync ENTER command=${command} _checking=${self._checking}`);
-      if (self._checking) {
+      debugLog(`cp.execSync ENTER command=${command} _checking=${self._checking} _executing=${self._executing}`);
+      if (self._checking || self._executing) {
         debugLog(`cp.execSync SKIP (re-entrancy) command=${command}`);
         return original(command, options);
       }
-      self._checking = true;
+      self.eventReporter.intercept("exec", command);
+      const policyResult = self.syncPolicyCheck(command);
+      const wrapped = self.wrapCommandStringWithSeatbelt(
+        command,
+        options,
+        policyResult
+      );
+      debugLog(`cp.execSync calling original command=${wrapped.command}`);
+      self._executing = true;
       try {
-        self.eventReporter.intercept("exec", command);
-        debugLog(`cp.execSync policy_check START command=${command}`);
-        const result = self.syncClient.request(
-          "policy_check",
-          { operation: "exec", target: command }
-        );
-        debugLog(`cp.execSync policy_check DONE allowed=${result.allowed} command=${command}`);
-        if (!result.allowed) {
-          throw new PolicyDeniedError(result.reason || "Operation denied by policy", {
-            operation: "exec",
-            target: command
-          });
-        }
-      } catch (error) {
-        debugLog(`cp.execSync policy_check ERROR: ${error.message} command=${command}`);
-        if (error instanceof PolicyDeniedError) {
-          throw error;
-        }
-        if (!self.failOpen) {
-          throw error;
-        }
+        return original(wrapped.command, wrapped.options);
       } finally {
-        self._checking = false;
+        self._executing = false;
       }
-      debugLog(`cp.execSync calling original command=${command}`);
-      return original(command, options);
     };
     return interceptedExecSync;
   }
@@ -672,17 +1103,31 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalSpawn;
     const interceptedSpawn = function(command, args, options) {
       const fullCmd = args ? `${command} ${args.join(" ")}` : command;
-      debugLog(`cp.spawn ENTER command=${fullCmd} _checking=${self._checking}`);
-      if (self._checking) {
+      debugLog(`cp.spawn ENTER command=${fullCmd} _checking=${self._checking} _executing=${self._executing}`);
+      if (self._checking || self._executing) {
         debugLog(`cp.spawn SKIP (re-entrancy) command=${fullCmd}`);
         return original(command, args, options || {});
       }
-      const fullCommand = args ? `${command} ${args.join(" ")}` : command;
-      self.eventReporter.intercept("exec", fullCommand);
-      self.checkPolicy("exec", fullCommand).catch((error) => {
-        self.eventReporter.error("exec", fullCommand, error.message);
-      });
-      return original(command, args, options || {});
+      self.eventReporter.intercept("exec", fullCmd);
+      let policyResult = null;
+      try {
+        policyResult = self.syncPolicyCheck(fullCmd);
+      } catch (error) {
+        debugLog(`cp.spawn DENIED command=${fullCmd}`);
+        const denied = original("false", [], { stdio: "pipe" });
+        process.nextTick(() => {
+          denied.emit("error", error);
+        });
+        return denied;
+      }
+      const wrapped = self.wrapWithSeatbelt(
+        command,
+        Array.from(args || []),
+        options,
+        policyResult
+      );
+      debugLog(`cp.spawn calling original command=${wrapped.command} args=${wrapped.args.join(" ")}`);
+      return original(wrapped.command, wrapped.args, wrapped.options || {});
     };
     return interceptedSpawn;
   }
@@ -691,77 +1136,130 @@ var ChildProcessInterceptor = class extends BaseInterceptor {
     const original = this.originalSpawnSync;
     return function interceptedSpawnSync(command, args, options) {
       const fullCommand = args ? `${command} ${args.join(" ")}` : command;
-      debugLog(`cp.spawnSync ENTER command=${fullCommand} _checking=${self._checking}`);
-      if (self._checking) {
+      debugLog(`cp.spawnSync ENTER command=${fullCommand} _checking=${self._checking} _executing=${self._executing}`);
+      if (self._checking || self._executing) {
         debugLog(`cp.spawnSync SKIP (re-entrancy) command=${fullCommand}`);
         return original(command, args, options);
       }
-      self._checking = true;
+      self.eventReporter.intercept("exec", fullCommand);
+      let policyResult = null;
       try {
-        self.eventReporter.intercept("exec", fullCommand);
-        debugLog(`cp.spawnSync policy_check START command=${fullCommand}`);
-        const result = self.syncClient.request(
-          "policy_check",
-          { operation: "exec", target: fullCommand }
-        );
-        debugLog(`cp.spawnSync policy_check DONE allowed=${result.allowed} command=${fullCommand}`);
-        if (!result.allowed) {
-          return {
-            pid: -1,
-            output: [],
-            stdout: Buffer.alloc(0),
-            stderr: Buffer.from(result.reason || "Policy denied"),
-            status: 1,
-            signal: null,
-            error: new PolicyDeniedError(result.reason || "Policy denied")
-          };
-        }
+        policyResult = self.syncPolicyCheck(fullCommand);
       } catch (error) {
-        debugLog(`cp.spawnSync policy_check ERROR: ${error.message} command=${fullCommand}`);
-        if (!self.failOpen) {
-          return {
-            pid: -1,
-            output: [],
-            stdout: Buffer.alloc(0),
-            stderr: Buffer.from(error.message),
-            status: 1,
-            signal: null,
-            error
-          };
-        }
-      } finally {
-        self._checking = false;
+        debugLog(`cp.spawnSync DENIED command=${fullCommand}`);
+        return {
+          pid: -1,
+          output: [],
+          stdout: Buffer.alloc(0),
+          stderr: Buffer.from(
+            error instanceof PolicyDeniedError ? error.message || "Policy denied" : error.message
+          ),
+          status: 1,
+          signal: null,
+          error
+        };
       }
-      debugLog(`cp.spawnSync calling original command=${fullCommand}`);
-      return original(command, args, options);
+      const wrapped = self.wrapWithSeatbelt(
+        command,
+        Array.from(args || []),
+        options,
+        policyResult
+      );
+      debugLog(`cp.spawnSync calling original command=${wrapped.command}`);
+      return original(
+        wrapped.command,
+        wrapped.args,
+        wrapped.options
+      );
     };
   }
   createInterceptedExecFile() {
     const self = this;
     const original = this.originalExecFile;
-    return function interceptedExecFile(file, ...args) {
-      if (self._checking) {
-        return original(file, ...args);
+    return function interceptedExecFile(file, ...rest) {
+      if (self._checking || self._executing) {
+        return original(file, ...rest);
       }
-      self.eventReporter.intercept("exec", file);
-      self.checkPolicy("exec", file).catch((error) => {
-        self.eventReporter.error("exec", file, error.message);
-      });
-      return original(file, ...args);
+      let args = [];
+      let options;
+      let callback;
+      for (const arg of rest) {
+        if (typeof arg === "function") {
+          callback = arg;
+        } else if (Array.isArray(arg)) {
+          args = arg;
+        } else if (typeof arg === "object" && arg !== null) {
+          options = arg;
+        }
+      }
+      const fullCommand = args.length > 0 ? `${file} ${args.join(" ")}` : file;
+      debugLog(`cp.execFile ENTER command=${fullCommand}`);
+      self.eventReporter.intercept("exec", fullCommand);
+      let policyResult = null;
+      try {
+        policyResult = self.syncPolicyCheck(fullCommand);
+      } catch (error) {
+        if (callback) {
+          process.nextTick(() => callback(error, "", ""));
+        }
+        return original("false");
+      }
+      const wrapped = self.wrapWithSeatbelt(file, args, options, policyResult);
+      debugLog(`cp.execFile calling original command=${wrapped.command}`);
+      if (callback) {
+        return original(
+          wrapped.command,
+          wrapped.args,
+          wrapped.options,
+          callback
+        );
+      }
+      return original(
+        wrapped.command,
+        wrapped.args,
+        wrapped.options || {},
+        // eslint-disable-next-line @typescript-eslint/no-empty-function
+        () => {
+        }
+      );
     };
   }
   createInterceptedFork() {
     const self = this;
     const original = this.originalFork;
     const interceptedFork = function(modulePath, args, options) {
-      if (self._checking) {
+      if (self._checking || self._executing) {
         return original(modulePath, args, options);
       }
       const pathStr = modulePath.toString();
-      self.eventReporter.intercept("exec", `fork:${pathStr}`);
-      self.checkPolicy("exec", `fork:${pathStr}`).catch((error) => {
-        self.eventReporter.error("exec", pathStr, error.message);
-      });
+      const fullCommand = `fork:${pathStr}`;
+      debugLog(`cp.fork ENTER command=${fullCommand}`);
+      self.eventReporter.intercept("exec", fullCommand);
+      let policyResult = null;
+      try {
+        policyResult = self.syncPolicyCheck(fullCommand);
+      } catch (error) {
+        debugLog(`cp.fork DENIED command=${fullCommand}`);
+        const denied = self.originalSpawn("false", [], { stdio: "pipe" });
+        process.nextTick(() => {
+          denied.emit("error", error);
+        });
+        return denied;
+      }
+      if (policyResult?.sandbox) {
+        const sandbox = policyResult.sandbox;
+        const env = { ...options?.env || process.env };
+        if (sandbox.envInjection) {
+          Object.assign(env, sandbox.envInjection);
+        }
+        if (sandbox.envDeny) {
+          for (const key of sandbox.envDeny) {
+            delete env[key];
+          }
+        }
+        options = { ...options, env };
+      }
+      debugLog(`cp.fork calling original module=${pathStr}`);
       return original(modulePath, args, options);
     };
     return interceptedFork;
@@ -855,19 +1353,19 @@ var FsInterceptor = class extends BaseInterceptor {
     const key = `fs:${methodName}`;
     this.originals.set(key, original);
     const self = this;
-    safeOverride(module2, methodName, function intercepted(path, ...args) {
-      const pathString = normalizePathArg(path);
+    safeOverride(module2, methodName, function intercepted(path2, ...args) {
+      const pathString = normalizePathArg(path2);
       const callback = typeof args[args.length - 1] === "function" ? args.pop() : void 0;
       debugLog(`fs.${methodName} ENTER (async) path=${pathString} _checking=${self._checking}`);
       if (self._checking) {
         debugLog(`fs.${methodName} SKIP (re-entrancy, async) path=${pathString}`);
-        original.call(module2, path, ...args, callback);
+        original.call(module2, path2, ...args, callback);
         return;
       }
       self.eventReporter.intercept(operation, pathString);
       self.checkPolicy(operation, pathString).then(() => {
         debugLog(`fs.${methodName} policy OK (async) path=${pathString}`);
-        original.call(module2, path, ...args, callback);
+        original.call(module2, path2, ...args, callback);
       }).catch((error) => {
         debugLog(`fs.${methodName} policy ERROR (async): ${error.message} path=${pathString}`);
         if (callback) {
@@ -882,12 +1380,12 @@ var FsInterceptor = class extends BaseInterceptor {
     const key = `fs:${methodName}`;
     this.originals.set(key, original);
     const self = this;
-    safeOverride(module2, methodName, function interceptedSync(path, ...args) {
-      const pathString = normalizePathArg(path);
+    safeOverride(module2, methodName, function interceptedSync(path2, ...args) {
+      const pathString = normalizePathArg(path2);
       debugLog(`fs.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
       if (self._checking) {
         debugLog(`fs.${methodName} SKIP (re-entrancy) path=${pathString}`);
-        return original.call(module2, path, ...args);
+        return original.call(module2, path2, ...args);
       }
       self._checking = true;
       try {
@@ -916,7 +1414,7 @@ var FsInterceptor = class extends BaseInterceptor {
         self._checking = false;
       }
       debugLog(`fs.${methodName} calling original path=${pathString}`);
-      return original.call(module2, path, ...args);
+      return original.call(module2, path2, ...args);
     });
   }
   interceptPromiseMethod(module2, methodName, operation) {
@@ -925,17 +1423,17 @@ var FsInterceptor = class extends BaseInterceptor {
     const key = `fsPromises:${methodName}`;
     this.originals.set(key, original);
     const self = this;
-    safeOverride(module2, methodName, async function interceptedPromise(path, ...args) {
-      const pathString = normalizePathArg(path);
+    safeOverride(module2, methodName, async function interceptedPromise(path2, ...args) {
+      const pathString = normalizePathArg(path2);
       debugLog(`fsPromises.${methodName} ENTER path=${pathString} _checking=${self._checking}`);
       if (self._checking) {
         debugLog(`fsPromises.${methodName} SKIP (re-entrancy) path=${pathString}`);
-        return original.call(module2, path, ...args);
+        return original.call(module2, path2, ...args);
       }
       self.eventReporter.intercept(operation, pathString);
       await self.checkPolicy(operation, pathString);
       debugLog(`fsPromises.${methodName} policy OK path=${pathString}`);
-      return original.call(module2, path, ...args);
+      return original.call(module2, path2, ...args);
     });
   }
 };
@@ -1079,11 +1577,11 @@ var PolicyEvaluator = class {
    * Check if an operation is allowed
    * Always queries the daemon for fresh policy decisions
    */
-  async check(operation, target) {
+  async check(operation, target, context) {
     try {
       const result = await this.client.request(
         "policy_check",
-        { operation, target }
+        { operation, target, context }
       );
       return result;
     } catch (error) {
@@ -1127,7 +1625,11 @@ var EventReporter = class _EventReporter {
     const level = this.getLogLevel(event);
     if (this.shouldLog(level)) {
       const prefix = event.type === "allow" ? "\u2713" : event.type === "deny" ? "\u2717" : "\u2022";
-      console[level](`[AgenShield] ${prefix} ${event.operation}: ${event.target}`);
+      let detail = `${prefix} ${event.operation}: ${event.target}`;
+      if (event.policyId) detail += ` [policy:${event.policyId}]`;
+      if (event.error) detail += ` [reason:${event.error}]`;
+      if (event.duration) detail += ` [${event.duration}ms]`;
+      console[level](`[AgenShield] ${detail}`);
     }
     if (this.queue.length >= 100) {
       this.flush();
@@ -1247,6 +1749,13 @@ function installInterceptors(configOverrides) {
     return;
   }
   const config = createConfig(configOverrides);
+  if (config.logLevel === "debug") {
+    try {
+      const safeConfig = { ...config };
+      console.error("[AgenShield:config]", JSON.stringify(safeConfig, null, 2));
+    } catch {
+    }
+  }
   client = new AsyncClient({
     socketPath: config.socketPath,
     httpHost: config.httpHost,
@@ -1267,7 +1776,8 @@ function installInterceptors(configOverrides) {
       policyEvaluator,
       eventReporter,
       failOpen: config.failOpen,
-      brokerHttpPort: config.httpPort
+      brokerHttpPort: config.httpPort,
+      config
     });
     installed.fetch.install();
     log(config, "debug", "Installed fetch interceptor");
@@ -1300,7 +1810,8 @@ function installInterceptors(configOverrides) {
       policyEvaluator,
       eventReporter,
       failOpen: config.failOpen,
-      brokerHttpPort: config.httpPort
+      brokerHttpPort: config.httpPort,
+      config
     });
     installed.childProcess.install();
     log(config, "debug", "Installed child_process interceptor");