@archme/cli 0.13.0 → 0.14.0

package/dist/cli.js

@@ -8291,9 +8291,13 @@ var init_execa = __esm({
 // src/auth/credentials.ts
 var credentials_exports = {};
 __export(credentials_exports, {
+  CredentialStoreError: () => CredentialStoreError,
+  CredentialStoreUnreadableError: () => CredentialStoreUnreadableError,
+  CredentialStoreUnwritableError: () => CredentialStoreUnwritableError,
   clearCredential: () => clearCredential,
   clearCredentials: () => clearCredentials,
   credentialKind: () => credentialKind,
+  credentialStoreMessage: () => credentialStoreMessage,
   describeCredentialSource: () => describeCredentialSource,
   loadAllCredentials: () => loadAllCredentials,
   loadCredentials: () => loadCredentials,
@@ -8344,10 +8348,32 @@ function parseStore(raw) {
 function serializeStore(identities) {
   return JSON.stringify({ v: 2, identities }, null, 2);
 }
+function credentialStoreMessage(platform3, detail, action = "read") {
+  const lead = `Could not ${action} your ArchMe sign-in`;
+  if (platform3 === "darwin") {
+    return `${lead}: the macOS login keychain is locked (common over SSH). Run \`security unlock-keychain ~/Library/Keychains/login.keychain-db\`, or run this from the Mac's desktop session. (keytar: ${detail})`;
+  }
+  if (platform3 === "linux") {
+    return `${lead}: the system keyring (Secret Service) is locked or unavailable (common over SSH): ${detail}. Unlock the keyring, or run this from your desktop session.`;
+  }
+  return `${lead} from the OS credential store: ${detail}`;
+}
+async function keychainWrite(action, op) {
+  try {
+    return await op();
+  } catch (err4) {
+    throw new CredentialStoreUnwritableError(action, err4);
+  }
+}
 async function readStore(supabaseUrl) {
   const keytar = await loadKeytar();
   if (keytar) {
-    const raw = await keytar.getPassword(SERVICE_NAME, supabaseUrl);
+    let raw;
+    try {
+      raw = await keytar.getPassword(SERVICE_NAME, supabaseUrl);
+    } catch (err4) {
+      throw new CredentialStoreUnreadableError(err4);
+    }
     return { list: raw ? parseStore(raw).filter((c3) => c3.supabase_url === supabaseUrl) : [], source: "keychain" };
   }
   const all = await readFileStore();
@@ -8383,12 +8409,7 @@ async function saveCredentials(credentials) {
       const merged2 = mergeBindings(credentials, prior2);
       const next2 = list2.filter((c3) => c3.device_id !== credentials.device_id);
       next2.push(merged2);
-      try {
-        await keytar.setPassword(SERVICE_NAME, credentials.supabase_url, serializeStore(next2));
-      } catch (err4) {
-        warnCredentialPersistFailure("macOS Keychain", err4);
-        throw err4;
-      }
+      await keychainWrite("save", () => keytar.setPassword(SERVICE_NAME, credentials.supabase_url, serializeStore(next2)));
       return { credentials: merged2, source: "keychain" };
     }
     const all = await readFileStore();
@@ -8411,10 +8432,10 @@ async function replaceUrlCredentials(supabaseUrl, creds) {
     const keytar = await loadKeytar();
     if (keytar) {
       if (creds.length === 0) {
-        await keytar.deletePassword(SERVICE_NAME, supabaseUrl);
+        await keychainWrite("remove", () => keytar.deletePassword(SERVICE_NAME, supabaseUrl));
         return { credentials: null, source: "keychain" };
       }
-      await keytar.setPassword(SERVICE_NAME, supabaseUrl, serializeStore(creds));
+      await keychainWrite("save", () => keytar.setPassword(SERVICE_NAME, supabaseUrl, serializeStore(creds)));
       return { credentials: creds[creds.length - 1], source: "keychain" };
     }
     const all = await readFileStore();
@@ -8437,10 +8458,10 @@ async function removeFromStore(supabaseUrl, match2) {
       const { list: list2 } = await readStore(supabaseUrl);
       const remaining = list2.filter((c3) => !match2(c3));
       if (remaining.length === 0) {
-        await keytar.deletePassword(SERVICE_NAME, supabaseUrl);
+        await keychainWrite("remove", () => keytar.deletePassword(SERVICE_NAME, supabaseUrl));
         return;
       }
-      await keytar.setPassword(SERVICE_NAME, supabaseUrl, serializeStore(remaining));
+      await keychainWrite("remove", () => keytar.setPassword(SERVICE_NAME, supabaseUrl, serializeStore(remaining)));
       return;
     }
     const all = await readFileStore();
@@ -8480,12 +8501,31 @@ async function loadKeytar() {
     return null;
   }
 }
-var SERVICE_NAME, storeMutex;
+var SERVICE_NAME, storeMutex, CredentialStoreError, CredentialStoreUnreadableError, CredentialStoreUnwritableError;
 var init_credentials = __esm({
   "src/auth/credentials.ts"() {
     "use strict";
     SERVICE_NAME = "archme-daemon";
     storeMutex = Promise.resolve();
+    CredentialStoreError = class extends Error {
+      constructor(action, cause, platform3 = process.platform) {
+        super(credentialStoreMessage(platform3, cause instanceof Error ? cause.message : String(cause), action), { cause });
+        this.action = action;
+        this.name = "CredentialStoreError";
+      }
+    };
+    CredentialStoreUnreadableError = class extends CredentialStoreError {
+      constructor(cause, platform3 = process.platform) {
+        super("read", cause, platform3);
+        this.name = "CredentialStoreUnreadableError";
+      }
+    };
+    CredentialStoreUnwritableError = class extends CredentialStoreError {
+      constructor(action, cause, platform3 = process.platform) {
+        super(action, cause, platform3);
+        this.name = "CredentialStoreUnwritableError";
+      }
+    };
   }
 });
 
@@ -9294,7 +9334,14 @@ async function mintKeyedAccount(deps) {
       `Created ${parsed.handle}${saved ? " and saved its key" : ""}, but signing in failed: ${grant.error}. ` + (saved ? "Run `archme login --key` to try again." : `Try again with the key printed above: ${KEY_VIA_ENV}.`)
     );
   }
-  await storeKeyedLogin(deps, grant, data);
+  try {
+    await storeKeyedLogin(deps, grant, data);
+  } catch (err4) {
+    if (!(err4 instanceof CredentialStoreError)) throw err4;
+    throw new LoginError(
+      `${err4.message} Your account ${parsed.handle} was created${saved ? " and its key saved" : ""}; once that's fixed, sign in with it: ${saved ? "`archme login --key`" : KEY_VIA_ENV}.`
+    );
+  }
   deps.log(`\u2713 Created your ArchMe account ${parsed.handle} \u2014 no email or password, just a key.`);
   if (saved) {
     deps.log(`  The key is saved in ${deps.keyRingPath}. Save it in your password manager too: it is the`);
@@ -9895,7 +9942,17 @@ async function ensureStartPrerequisites(opts = {}) {
       `archme daemon service commands are not supported on ${platform3}. Use \`archme daemon run\` for foreground operation.`
     );
   }
-  const signedIn = opts.isSignedIn ? await opts.isSignedIn() : await defaultIsSignedIn(env);
+  let signedIn;
+  try {
+    signedIn = opts.isSignedIn ? await opts.isSignedIn() : await defaultIsSignedIn(env);
+  } catch (err4) {
+    if (!(err4 instanceof CredentialStoreUnreadableError)) throw err4;
+    const controller = opts.controller ?? pickController(platform3, env);
+    if (!await controller.unitExists()) throw err4;
+    console.error(`Warning: ${err4.message}
+Starting the installed service anyway; it reads its own sign-in when it boots.`);
+    return;
+  }
   if (!signedIn) {
     if (!opts.noLogin && isatty(0) && isatty(1)) {
       out.write("Not signed in \u2014 launching `archme login`\u2026\n");
@@ -9920,7 +9977,7 @@ async function runStartFlow(opts = {}) {
     stderrPath: logPaths.stderr
   };
   const unitContent = platform3 === "darwin" ? renderLaunchdPlist(renderOpts) : renderSystemdUnit(renderOpts);
-  const controller = pickController(platform3, env);
+  const controller = opts.controller ?? pickController(platform3, env);
   const result = await orchestrateStart(controller, unitContent, {
     skipStart: opts.start === false
   });
@@ -9946,6 +10003,7 @@ var init_install = __esm({
     init_paths();
     init_unitFiles();
     init_serviceController();
+    init_credentials();
     ENV_KEYS_TO_BAKE = [
       "PATH",
       "HOME",
@@ -10102,10 +10160,15 @@ var init_logs = __esm({
 import { readFile as readFile5, stat as stat2 } from "node:fs/promises";
 function renderStatus(s) {
   const lines = [];
+  const unreadable = s.credentials && "unreadable" in s.credentials ? s.credentials.unreadable : null;
+  const early = (exitCode) => {
+    if (unreadable) lines.push(`Signed in:  unknown \u2014 ${unreadable}`);
+    return { exitCode, rendered: lines.join("\n") + "\n" };
+  };
   if (!s.unitInstalled) {
     lines.push(`Service:    ${LABEL} (not installed)`);
     lines.push("Run `archme daemon start` to install + start.");
-    return { exitCode: 1, rendered: lines.join("\n") + "\n" };
+    return early(1);
   }
   const serviceStateBits = ["installed"];
   if (s.inspection.enabled) serviceStateBits.push("enabled at login");
@@ -10113,17 +10176,19 @@ function renderStatus(s) {
   lines.push(`Service:    ${LABEL} (${serviceStateBits.join(", ")})`);
   if (!s.inspection.loaded) {
     lines.push("Process:    installed, not running \u2014 run `archme daemon start` to load + start the service.");
-    return { exitCode: 2, rendered: lines.join("\n") + "\n" };
+    return early(2);
   }
   if (!s.inspection.running) {
     lines.push("Process:    service loaded but no process");
     lines.push("Check `archme daemon logs` for crash details.");
-    return { exitCode: 2, rendered: lines.join("\n") + "\n" };
+    return early(2);
   }
   const uptime = s.uptimeMs != null ? `, uptime ${formatDuration(s.uptimeMs)}` : "";
   lines.push(`Process:    running, pid ${s.inspection.pid}${uptime}`);
   let unhealthy = false;
-  if (s.credentials) {
+  if (unreadable) {
+    lines.push(`Signed in:  unknown \u2014 ${unreadable}`);
+  } else if (s.credentials && "deviceId" in s.credentials) {
     const dev = s.credentials.deviceId ?? "unknown";
     const who = s.credentials.email ?? "OAuth user";
     lines.push(`Signed in:  ${who}  device ${dev}`);
@@ -10193,7 +10258,8 @@ async function gatherStatus(d) {
   let supabase = null;
   if (inspection.running) {
     try {
-      supabase = await d.loadSupabaseState(credentials?.deviceId ?? null);
+      const deviceId = credentials && "deviceId" in credentials ? credentials.deviceId : null;
+      supabase = await d.loadSupabaseState(deviceId);
     } catch {
       supabase = { reachable: false, inFlightJob: null };
     }
@@ -16391,15 +16457,23 @@ var init_sessionAuth = __esm({
           this.userId = resolveUserId(userInfo2, ctx.fallbackUserId);
           this.lastUserInfo = userInfo2;
         }
-        const saved = await saveCredentials({
-          kind: this.kind,
-          refresh_token: nextRefreshToken,
-          access_token: this.accessToken,
-          org_id: ctx.orgId,
-          device_id: ctx.deviceId,
-          user_id: this.userId ?? void 0,
-          supabase_url: this.cfg.supabaseUrl
-        });
+        let saved = null;
+        try {
+          saved = await saveCredentials({
+            kind: this.kind,
+            refresh_token: nextRefreshToken,
+            access_token: this.accessToken,
+            org_id: ctx.orgId,
+            device_id: ctx.deviceId,
+            user_id: this.userId ?? void 0,
+            supabase_url: this.cfg.supabaseUrl
+          });
+        } catch (err4) {
+          if (!(err4 instanceof CredentialStoreError)) throw err4;
+          console.error(
+            `auth: ${err4.message} The refreshed sign-in was NOT saved: this process keeps working, but the saved one is now out of date. If this process ends before a later refresh saves it, sign in again then. ${this.reloginHint()}`
+          );
+        }
         return { userInfo: userInfo2, saved, nextRefreshToken };
       }
       // The timer closure reads the LIVE this.refreshToken/deviceId/orgId at fire
@@ -16492,11 +16566,11 @@ var init_sessionAuth = __esm({
           const refreshed = await this.refreshOrRecover(refreshToken, this.userId);
           if (!refreshed.ok) {
             if (refreshed.permanent) {
-              await clearCredential(this.cfg.supabaseUrl, deviceId);
+              const notCleared = await this.clearStoredCredential(deviceId);
               this.clearTokensOnly();
               throw new LoadStoredAndRefreshError(
                 "invalid_grant",
-                `${errorPrefix} failed permanently: ${refreshed.error}. ${this.reloginHint()}`
+                `${errorPrefix} failed permanently: ${refreshed.error}. ${this.reloginHint()}${notCleared}`
               );
             }
             throw new LoadStoredAndRefreshError("transient", `${errorPrefix} failed: ${refreshed.error}`);
@@ -16507,7 +16581,7 @@ var init_sessionAuth = __esm({
             orgId,
             fallbackUserId: this.userId ?? void 0
           });
-          console.log(`auth: persisted refreshed token to ${describeCredentialSource(saved)}`);
+          if (saved) console.log(`auth: persisted refreshed token to ${describeCredentialSource(saved)}`);
         })();
         this.refreshInFlight = p;
         return p.finally(() => {
@@ -16520,6 +16594,18 @@ var init_sessionAuth = __esm({
         if (refreshed.ok || !refreshed.permanent) return refreshed;
         return this.signInWithSavedKey(userId, refreshed.error);
       }
+      // Remove a dead login from the store. The token is revoked whether or not
+      // this works, so a store that refuses the delete must not turn a permanent
+      // failure into a transient one (which would retry a dead token forever).
+      async clearStoredCredential(deviceId) {
+        try {
+          await clearCredential(this.cfg.supabaseUrl, deviceId);
+          return "";
+        } catch (err4) {
+          if (!(err4 instanceof CredentialStoreError)) throw err4;
+          return ` (${err4.message})`;
+        }
+      }
       reloginHint() {
         return this.kind === "key" ? "Run `archme login --key` to sign in with your key again." : "Run `archme login` to pair again.";
       }
@@ -16564,10 +16650,10 @@ var init_sessionAuth = __esm({
         const refreshed = await this.refreshOrRecover(stored.refresh_token, stored.user_id ?? null);
         if (!refreshed.ok) {
           if (refreshed.permanent) {
-            await clearCredential(this.cfg.supabaseUrl, stored.device_id);
+            const notCleared = await this.clearStoredCredential(stored.device_id);
             throw new LoadStoredAndRefreshError(
               "invalid_grant",
-              `stored archme credentials are invalid or revoked: ${refreshed.error}. ${this.reloginHint()}`
+              `stored archme credentials are invalid or revoked: ${refreshed.error}. ${this.reloginHint()}${notCleared}`
             );
           }
           throw new LoadStoredAndRefreshError("transient", `token refresh failed (transient): ${refreshed.error}`);
@@ -16941,12 +17027,12 @@ function defaultReadFile(path7) {
   return readFileSync4(path7, "utf8");
 }
 function findPackageRoot2(startDir, opts = {}) {
-  const readFile19 = opts.readFile ?? defaultReadFile;
+  const readFile20 = opts.readFile ?? defaultReadFile;
   const stopAt = parse(startDir).root;
   let dir = startDir;
   for (; ; ) {
     try {
-      const parsed = JSON.parse(readFile19(join16(dir, "package.json")));
+      const parsed = JSON.parse(readFile20(join16(dir, "package.json")));
       if (parsed.name === PACKAGE_NAME) return dir;
     } catch {
     }
@@ -18343,6 +18429,26 @@ function expandHome(p, home2) {
   if (p.startsWith("~/")) return join20(home2, p.slice(2));
   return p;
 }
+function sandboxTokenLocation(env, home2 = homedir6()) {
+  const raw = (env.ARCHME_SANDBOX_CLAUDE_TOKEN_FILE ?? "").trim();
+  return raw ? { path: expandHome(raw, home2), override: true } : { path: join20(home2, ".archme", "sandbox-claude-token"), override: false };
+}
+function resolveSandboxImage(env, shippedImage) {
+  let image = (env.ARCHME_SANDBOX_IMAGE ?? "").trim();
+  if (!image) {
+    try {
+      image = shippedImage() ?? "";
+    } catch (e) {
+      throw new SandboxSettingsError(`the shipped sandbox image is unusable: ${e.message}`);
+    }
+  }
+  if (!image) {
+    throw new SandboxSettingsError(
+      "no sandbox image: this install ships no sandbox-image.json, so set ARCHME_SANDBOX_IMAGE"
+    );
+  }
+  return image;
+}
 function readSandboxSettings(env, concurrency, home2 = homedir6(), shippedImage = () => null) {
   const modeRaw = (env.ARCHME_SANDBOX ?? "").trim().toLowerCase() || "off";
   if (modeRaw !== "off" && modeRaw !== "shadow" && modeRaw !== "required") {
@@ -18358,14 +18464,10 @@ function readSandboxSettings(env, concurrency, home2 = homedir6(), shippedImage
     boxCpus: SANDBOX_DEFAULTS.boxCpus,
     volumeGiB: SANDBOX_DEFAULTS.volumeGiB,
     maxModelRequests: SANDBOX_DEFAULTS.maxModelRequests,
-    claudeTokenPath: join20(home2, ".archme", "sandbox-claude-token")
+    claudeTokenPath: sandboxTokenLocation({}, home2).path,
+    claudeTokenOverride: false
   };
   if (mode === "off") return { mode, ...base };
-  if (mode === "required") {
-    throw new SandboxSettingsError(
-      "ARCHME_SANDBOX=required needs network confinement (pf + the GitHub gatekeeper, step 19.3), which this release does not have; use ARCHME_SANDBOX=shadow"
-    );
-  }
   if (!Number.isInteger(concurrency)) {
     throw new SandboxSettingsError(`MAX_CONCURRENT_JOBS must be a whole number (got ${concurrency})`);
   }
@@ -18378,23 +18480,11 @@ function readSandboxSettings(env, concurrency, home2 = homedir6(), shippedImage
   if (runtime !== "apple-container") {
     throw new SandboxSettingsError(`ARCHME_SANDBOX_RUNTIME must be apple-container (got "${runtime}")`);
   }
-  let image = (env.ARCHME_SANDBOX_IMAGE ?? "").trim();
-  if (!image) {
-    try {
-      image = shippedImage() ?? "";
-    } catch (e) {
-      throw new SandboxSettingsError(`the shipped sandbox image is unusable: ${e.message}`);
-    }
-  }
-  if (!image) {
-    throw new SandboxSettingsError(
-      "no sandbox image: this install ships no sandbox-image.json, so set ARCHME_SANDBOX_IMAGE"
-    );
-  }
-  const projects = new Set(
+  const image = resolveSandboxImage(env, shippedImage);
+  const projects = mode === "required" ? /* @__PURE__ */ new Set() : new Set(
     (env.ARCHME_SANDBOX_PROJECTS ?? "").split(",").map((s) => s.trim()).filter(Boolean)
   );
-  const tokenRaw = (env.ARCHME_SANDBOX_CLAUDE_TOKEN_FILE ?? "").trim();
+  const token = sandboxTokenLocation(env, home2);
   return {
     mode,
     projects,
@@ -18407,7 +18497,8 @@ function readSandboxSettings(env, concurrency, home2 = homedir6(), shippedImage
     boxCpus: SANDBOX_DEFAULTS.boxCpus,
     volumeGiB: intEnv(env, "ARCHME_SANDBOX_VOLUME_GIB", SANDBOX_DEFAULTS.volumeGiB, { min: 1 }),
     maxModelRequests: intEnv(env, "ARCHME_SANDBOX_MAX_MODEL_REQUESTS", SANDBOX_DEFAULTS.maxModelRequests, { min: 1 }),
-    claudeTokenPath: tokenRaw ? expandHome(tokenRaw, home2) : base.claudeTokenPath
+    claudeTokenPath: token.path,
+    claudeTokenOverride: token.override
   };
 }
 function shouldSandbox(settings, job, { isLocalRepo }) {
@@ -18483,6 +18574,132 @@ var init_imageManifest = __esm({
   }
 });
 
+// src/daemon/sandboxJob/result.ts
+import { readFile as readFile13 } from "node:fs/promises";
+function isValidNonce(nonce) {
+  return typeof nonce === "string" && RESULT_NONCE_RE.test(nonce);
+}
+function encode(result, nonce) {
+  return `${RESULT_PREFIX}${nonce} ${Buffer.from(JSON.stringify(result), "utf8").toString("base64")}`;
+}
+function fits(line, cap) {
+  return Buffer.byteLength(line, "utf8") <= cap;
+}
+function withTruncatedError(r) {
+  return { ...r, error: r.error ? `${r.error}; ${RESULT_TRUNCATED}` : RESULT_TRUNCATED };
+}
+function minimal(r) {
+  if (r.kind === "probe") {
+    const m2 = { kind: "probe", outcomes: {}, memoryPeakBytes: r.memoryPeakBytes, durations_ms: {}, error: RESULT_TRUNCATED };
+    return m2;
+  }
+  if (r.kind === "clone") {
+    const m2 = { kind: "clone", outcome: r.outcome, memoryPeakBytes: r.memoryPeakBytes, durations_ms: {}, error: RESULT_TRUNCATED };
+    return m2;
+  }
+  const m = {
+    kind: "agent",
+    exitCode: r.exitCode,
+    signal: r.signal,
+    claudeStdout: "",
+    affected: null,
+    promptBytes: r.promptBytes,
+    memoryPeakBytes: r.memoryPeakBytes,
+    durations_ms: {},
+    error: RESULT_TRUNCATED
+  };
+  return m;
+}
+function formatResultLine(result, nonce, cap = RESULT_MAX_BYTES) {
+  if (!isValidNonce(nonce)) throw new Error("result: invalid nonce");
+  const encode_ = (r) => encode(r, nonce);
+  let line = encode_(result);
+  if (fits(line, cap)) return line;
+  if (result.kind === "agent") {
+    const noAffected = { ...result, affected: null };
+    line = encode_(withTruncatedError(noAffected));
+    if (fits(line, cap)) return line;
+    line = encode_(withTruncatedError({ ...noAffected, claudeStdout: "" }));
+    if (fits(line, cap)) return line;
+  }
+  return encode_(minimal(result));
+}
+function isObj(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isNumOrNull(v) {
+  return v === null || typeof v === "number" && Number.isFinite(v);
+}
+function shapeError(o2) {
+  if (!isNumOrNull(o2.memoryPeakBytes)) return "memoryPeakBytes";
+  if (!isObj(o2.durations_ms) || !Object.values(o2.durations_ms).every((v) => typeof v === "number")) return "durations_ms";
+  if (o2.error !== void 0 && typeof o2.error !== "string") return "error";
+  if (o2.kind === "clone") {
+    if (o2.outcome !== "diff" && o2.outcome !== "skip" && o2.outcome !== "rejected") return "outcome";
+    if (o2.diff !== void 0 && !isObj(o2.diff)) return "diff";
+    return null;
+  }
+  if (o2.kind === "probe") {
+    if (!isObj(o2.outcomes) || !Object.values(o2.outcomes).every((v) => typeof v === "string")) return "outcomes";
+    return null;
+  }
+  if (o2.kind === "agent") {
+    if (!isNumOrNull(o2.exitCode)) return "exitCode";
+    if (o2.signal !== null && typeof o2.signal !== "string") return "signal";
+    if (typeof o2.claudeStdout !== "string") return "claudeStdout";
+    if (o2.affected !== null && !(isObj(o2.affected) && ["stories", "components", "unresolvedFiles"].every((k) => Array.isArray(o2.affected[k])))) {
+      return "affected";
+    }
+    if (typeof o2.promptBytes !== "number") return "promptBytes";
+    return null;
+  }
+  return "kind";
+}
+function parseResultLine(stdout, nonce, cap = RESULT_MAX_BYTES) {
+  if (!isValidNonce(nonce)) return { ok: false, reason: "no result line" };
+  const prefix = `${RESULT_PREFIX}${nonce} `;
+  const lines = stdout.split("\n");
+  let line;
+  for (let i2 = lines.length - 1; i2 >= 0; i2--) {
+    const l = lines[i2].replace(/\r$/, "");
+    if (l.startsWith(prefix)) {
+      line = l;
+      break;
+    }
+  }
+  if (line === void 0) return { ok: false, reason: "no result line" };
+  if (Buffer.byteLength(line, "utf8") > cap) return { ok: false, reason: "result line exceeds cap" };
+  const b64 = line.slice(prefix.length).trim();
+  if (b64 === "" || b64.length % 4 !== 0 || !BASE64_RE.test(b64)) return { ok: false, reason: "result is not base64" };
+  let data;
+  try {
+    data = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
+  } catch {
+    return { ok: false, reason: "result is not JSON" };
+  }
+  if (!isObj(data)) return { ok: false, reason: "result is not an object" };
+  const bad = shapeError(data);
+  if (bad) return { ok: false, reason: `result has a malformed ${bad}` };
+  return { ok: true, result: data };
+}
+async function readMemoryPeak(path7 = "/sys/fs/cgroup/memory.peak", read = (p) => readFile13(p, "utf8")) {
+  try {
+    const n2 = Number.parseInt((await read(path7)).trim(), 10);
+    return Number.isFinite(n2) && n2 >= 0 ? n2 : null;
+  } catch {
+    return null;
+  }
+}
+var RESULT_TRUNCATED, BASE64_RE;
+var init_result2 = __esm({
+  "src/daemon/sandboxJob/result.ts"() {
+    "use strict";
+    init_types();
+    RESULT_TRUNCATED = "result truncated";
+    BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+  }
+});
+
 // src/daemon/sandbox/inputDir.ts
 import { mkdtemp as mkdtemp3, readdir as readdir2, rm as rm7, writeFile as writeFile10, chmod as chmod4 } from "node:fs/promises";
 import { tmpdir as tmpdir3 } from "node:os";
@@ -18514,893 +18731,1272 @@ var init_inputDir = __esm({
   }
 });
 
-// src/daemon/sandbox/host.ts
-import { constants as fsConstants } from "node:fs";
-import { open as open3 } from "node:fs/promises";
-function sandboxBootFailurePolicy(mode) {
-  return mode === "shadow" ? "run_unboxed" : "refuse";
-}
-function shutdownKillTargets(boxedJobs2, registry) {
-  return [...boxedJobs2].filter((id) => registry.hasLiveBoxes(id));
-}
-async function readClaudeTokenFile(path7) {
-  let fh;
-  try {
-    fh = await open3(path7, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
-  } catch (e) {
-    throw new SandboxBootError(`cannot read the sandbox Claude token at ${path7}: ${e.message}`);
-  }
-  try {
-    const st = await fh.stat();
-    if (!st.isFile()) throw new SandboxBootError(`sandbox Claude token ${path7} is not a regular file`);
-    if ((st.mode & 63) !== 0) {
-      throw new SandboxBootError(
-        `sandbox Claude token ${path7} is readable by group or others (mode ${(st.mode & 511).toString(8)}); chmod 600 it`
-      );
+// src/daemon/sandbox/sweep.ts
+async function sweepJobs(deps) {
+  const now = deps.now ?? Date.now;
+  const t0 = now();
+  const failures = [];
+  const boxes = [];
+  const volumes = [];
+  const jobBoxes = (await deps.list()).filter(isJobBox);
+  await Promise.all(jobBoxes.map(async (b) => {
+    try {
+      await deps.kill(b.id).catch(() => void 0);
+      await deps.remove(b.id);
+      boxes.push(b.id);
+    } catch (e) {
+      failures.push(`box ${b.id}: ${e.message}`);
     }
-    const token = (await fh.readFile("utf8")).trim();
-    if (!token) throw new SandboxBootError(`sandbox Claude token ${path7} is empty`);
-    if (!/^[\x21-\x7e]+$/.test(token)) {
-      throw new SandboxBootError(
-        `sandbox Claude token ${path7} contains whitespace or control characters; save it as one line`
-      );
+  }));
+  const jobVolumes = (await deps.listVolumes()).filter(isJobVolume);
+  for (const v of jobVolumes) {
+    try {
+      await deps.removeVolume(v.name);
+      volumes.push(v.name);
+    } catch (e) {
+      failures.push(`volume ${v.name}: ${e.message}`);
     }
-    return token;
-  } finally {
-    await fh.close();
   }
+  const report = { boxes: boxes.sort(), volumes, ms: now() - t0 };
+  if (failures.length > 0) throw new SweepError(report, failures);
+  return report;
 }
-async function bootSandbox(settings, parts, deps) {
-  const sweep = await parts.runtime.sweep();
-  const inputDirs = await (deps.sweepInputDirs ?? sweepInputDirs)();
-  deps.log(
-    `  sandbox: swept ${sweep.boxes.length} box(es), ${sweep.volumes.length} volume(s) in ${sweep.ms}ms, ${inputDirs} input dir(s)`
-  );
-  const slots = await parts.runtime.ensureSlots(settings.slots);
-  const pool = parts.makePool(slots);
-  const claudeToken = await (deps.readClaudeToken ?? readClaudeTokenFile)(settings.claudeTokenPath);
-  const gates = await parts.startGates(slots, {
-    mcpBaseUrl: deps.mcpBaseUrl,
-    claudeToken,
-    remint: deps.remint,
-    log: deps.log
-  });
-  let preflight;
-  try {
-    preflight = await parts.runtime.preflight();
-  } catch (e) {
-    await gates.close().catch(() => {
-    });
-    throw e;
-  }
-  if (!preflight.ok) {
-    await gates.close().catch(() => {
-    });
-    const failed = preflight.checks.filter((c3) => !c3.ok).map((c3) => `${c3.name}${c3.detail ? ` (${c3.detail})` : ""}`);
-    throw new SandboxBootError(`sandbox preflight failed: ${failed.join(", ") || "unknown"}`);
-  }
-  return {
-    host: { settings, runtime: parts.runtime, registry: parts.registry, gates, pool, io: parts.io },
-    sweep,
-    preflight
-  };
-}
-var SandboxBootError;
-var init_host = __esm({
-  "src/daemon/sandbox/host.ts"() {
+var JOB_VOLUME_PREFIX, SweepError, isJobBox, isJobVolume;
+var init_sweep = __esm({
+  "src/daemon/sandbox/sweep.ts"() {
     "use strict";
-    init_inputDir();
-    SandboxBootError = class extends Error {
-      constructor(message2) {
-        super(message2);
-        this.name = "SandboxBootError";
+    init_types();
+    JOB_VOLUME_PREFIX = "archme-job-";
+    SweepError = class extends Error {
+      constructor(report, failures) {
+        super(`sandbox sweep left ${failures.length} item(s): ${failures.join("; ")}`);
+        this.report = report;
+        this.failures = failures;
+        this.name = "SweepError";
       }
     };
+    isJobBox = (b) => JOB_LABEL in b.labels;
+    isJobVolume = (v) => v.name.startsWith(JOB_VOLUME_PREFIX) || JOB_LABEL in v.labels;
   }
 });
 
-// src/daemon/sandbox/runSandboxedJob.ts
-function sandboxJobOf(job) {
+// src/daemon/sandbox/appleContainer.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+import { homedir as homedir7 } from "node:os";
+import { isAbsolute, normalize } from "node:path";
+function assertName(kind, value) {
+  if (!NAME_RE.test(value)) throw new Error(`sandbox: invalid ${kind} name ${JSON.stringify(value)}`);
+}
+function assertImage(image) {
+  if (!image || image.startsWith("-") || /\s/.test(image)) {
+    throw new Error(`sandbox: invalid image ${JSON.stringify(image)}`);
+  }
+}
+function labelArgs(labels) {
+  const out = [];
+  for (const [k, v] of Object.entries(labels)) {
+    if (!LABEL_KEY_RE.test(k)) throw new Error(`sandbox: invalid label key ${JSON.stringify(k)}`);
+    if (CONTROL_RE.test(v)) throw new Error(`sandbox: label ${k} value contains a control character`);
+    out.push("--label", `${k}=${v}`);
+  }
+  return out;
+}
+function assertInputDir(dir, home2 = homedir7()) {
+  if (!isAbsolute(dir)) throw new Error(`sandbox: inputDir must be absolute: ${dir}`);
+  const strip2 = (p) => p.replace(/\/+$/, "") || "/";
+  const n2 = strip2(normalize(dir));
+  if (n2 !== strip2(dir)) throw new Error(`sandbox: inputDir must be normalized: ${dir}`);
+  if (/[:,]/.test(n2) || CONTROL_RE.test(n2)) throw new Error(`sandbox: inputDir has a forbidden character: ${dir}`);
+  const homeN = strip2(normalize(home2));
+  if (n2 === "/" || n2 === homeN || /^\/(Users|home)(\/[^/]+)?$/.test(n2) || n2 === "/root" || n2 === "/var/root") {
+    throw new Error(`sandbox: inputDir must not be / or a home directory: ${dir}`);
+  }
+}
+function envArgs(env) {
+  const out = [];
+  for (const [k, v] of Object.entries(env)) {
+    if (!ENV_KEY_RE.test(k)) throw new Error(`sandbox: invalid env key ${JSON.stringify(k)}`);
+    if (CONTROL_RE.test(v)) throw new Error(`sandbox: env ${k} value contains a newline or NUL`);
+    out.push("-e", `${k}=${v}`);
+  }
+  return out;
+}
+function slotFor(index) {
+  if (!Number.isInteger(index) || index < 0 || index >= MAX_SLOTS) {
+    throw new Error(`sandbox: slot index out of range: ${index}`);
+  }
+  const third = SLOT_RANGE_BASE_THIRD_OCTET + index;
   return {
-    id: job.id,
-    project_id: job.project_id,
-    repo_owner: job.repo_owner,
-    repo_name: job.repo_name,
-    repo_branch: job.repo_branch,
-    archme_branch: job.archme_branch,
-    before_sha: job.before_sha,
-    after_sha: job.after_sha,
-    forced: job.forced,
-    pr_number: job.pr_number ?? null,
-    source_mode: job.source_mode,
-    commit_message: job.commit_message ?? null,
-    head_commit_timestamp: job.head_commit_timestamp ?? null,
-    author_name: job.author_name ?? null,
-    author_login: job.author_login ?? null
+    index,
+    network: `archme-slot-${index}`,
+    subnet: `192.168.${third}.0/24`,
+    gateway: `192.168.${third}.1`
   };
 }
-async function runSandboxedJob(deps, job, opts) {
-  const { slot } = opts;
-  const t = { ...DEFAULT_SANDBOX_TIMEOUTS, ...opts.timeouts };
-  const pollMs = opts.pollMs ?? 1e3;
-  const now = deps.now ?? Date.now;
-  const { settings } = deps;
-  const volume = `archme-job-${job.id}`;
-  const labels = { [JOB_LABEL]: job.id, [SLOT_LABEL]: String(slot.index) };
-  const sjob = sandboxJobOf(job);
-  const sandbox = {
-    slot: slot.index,
-    memory_peak_bytes: { clone: null, agent: null },
-    model_requests: 0,
-    upstream_429: 0,
-    last_upstream_status: null,
-    cap_hits: 0,
-    mcp_requests: 0,
-    remints: 0,
-    clone_ms: null,
-    box_ms: 0
-  };
-  const durations = {};
-  const metrics = { sandbox, durations_ms: durations };
-  const liveBoxes = /* @__PURE__ */ new Set();
-  const inputCleanups = [];
-  let volumeTouched = false;
-  let agentStarted = false;
-  const readCounters = () => {
-    const c3 = deps.gates.countersFor(slot);
-    if (!c3) return;
-    sandbox.model_requests = c3.model_requests;
-    sandbox.upstream_429 = c3.upstream_429;
-    sandbox.last_upstream_status = c3.last_upstream_status;
-    sandbox.cap_hits = c3.cap_hits;
-    sandbox.mcp_requests = c3.mcp_requests;
-    sandbox.remints = c3.remints;
-  };
-  const failed = (step, reason, stderr = "") => {
-    deps.log(`sandbox ${step} step failed: ${reason}`);
-    return { kind: "step_failed", step, reason, stderr, metrics };
-  };
-  const currentKillCause = () => {
-    if (deps.isCancelled(job.id)) return "cancel";
-    if (deps.killReason(job.id) === "shutdown") return "shutdown";
-    if (deps.isLeaseLost(job.id)) return "lease_lost";
-    return null;
-  };
-  const writeInput = async (step, input) => {
-    const w = await deps.writeInputDir(step, input);
-    let done = false;
-    const cleanup = async () => {
-      if (done) return;
-      done = true;
-      await w.cleanup().catch(() => {
-      });
-    };
-    inputCleanups.push(cleanup);
-    return { dir: w.dir, cleanup };
-  };
-  const runBox = async (spec2, timeoutMs) => {
-    if (deps.isCancelled(job.id)) return { kind: "refused", reason: "cancel" };
-    if (!await deps.registry.beginStep(job.id, spec2.name)) return { kind: "refused", reason: "shutting_down" };
-    liveBoxes.add(spec2.name);
-    const started = now();
-    let killCause = null;
-    const kill = (cause) => {
-      if (killCause) return;
-      killCause = cause;
-      deps.log(`killing ${spec2.name} (${cause})`);
-      if (cause === "lease_lost") deps.gates.clearJob(slot);
-      void deps.runtime.kill(spec2.name).catch((e) => deps.log(`kill ${spec2.name} failed: ${e.message}`));
-    };
-    if (spec2.args[0] === "agent") agentStarted = true;
-    const handle = await deps.runtime.runStep(spec2);
-    const timer = setTimeout(() => kill("timeout"), timeoutMs);
-    const poll = setInterval(() => {
-      const c3 = currentKillCause();
-      if (c3) kill(c3);
-    }, pollMs);
-    try {
-      const exit = await handle.done;
-      liveBoxes.delete(spec2.name);
-      deps.registry.endStep(job.id, spec2.name);
-      if (!killCause && exit.killed) killCause = currentKillCause() ?? "shutdown";
-      return { kind: "ran", exit, killCause, ms: now() - started };
-    } finally {
-      clearTimeout(timer);
-      clearInterval(poll);
-    }
-  };
-  const spec = (step, network, env, inputDir) => ({
-    name: `archme-job-${job.id}-${step}`,
-    image: settings.image,
-    args: [step],
+function slotNetwork(slot) {
+  if (!slot || typeof slot !== "object") throw new Error("sandbox: a step needs a slot network");
+  const want = slotFor(slot.index);
+  if (slot.network !== want.network) throw new Error(`sandbox: ${slot.network} is not slot ${slot.index}'s network`);
+  return want.network;
+}
+function buildRunArgs(spec, home2) {
+  assertName("box", spec.name);
+  if (spec.volume !== void 0) assertName("volume", spec.volume);
+  assertImage(spec.image);
+  assertInputDir(spec.inputDir, home2);
+  if (!spec.labels[JOB_LABEL]) throw new Error(`sandbox: step labels must include ${JOB_LABEL}`);
+  const { cpus, memoryMiB } = spec.limits;
+  if (!Number.isInteger(cpus) || cpus < 1) throw new Error(`sandbox: invalid cpus ${cpus}`);
+  if (!Number.isInteger(memoryMiB) || memoryMiB < MIN_MEMORY_MIB) {
+    throw new Error(`sandbox: memoryMiB must be an integer \u2265 ${MIN_MEMORY_MIB}: ${memoryMiB}`);
+  }
+  const network = slotNetwork(spec.network);
+  return [
+    // `-i`: stdin carries the per-step result nonce (one line, then EOF) to
+    // the wrapper — the only channel that is neither a file, env nor argv.
+    "run",
+    "-i",
+    "--rm",
+    "--init",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--user",
+    `${BOX_UID}:${BOX_UID}`,
+    "--tmpfs",
+    "/tmp",
+    "--no-dns",
+    "--kernel-arg",
+    "ipv6.disable=1",
+    // Progress lines otherwise land on stderr ahead of the box's own output.
+    "--progress",
+    "none",
+    "--cpus",
+    String(cpus),
+    "--memory",
+    `${memoryMiB}M`,
+    "--name",
+    spec.name,
+    ...labelArgs(spec.labels),
+    "--network",
     network,
-    env,
-    inputDir,
-    volume,
-    limits: { cpus: settings.boxCpus, memoryMiB: settings.boxMemoryMiB },
-    labels: { ...labels }
-  });
-  const runBoxes = async (pre) => {
-    deps.registry.setVolume(job.id, volume);
-    volumeTouched = true;
-    await deps.runtime.createVolume(volume, settings.volumeGiB, labels);
-    await deps.runtime.initVolume(volume, BOX_UID, labels, settings.image);
-    deps.gates.bindJob(slot, {
-      jobId: job.id,
-      maxModelRequests: settings.maxModelRequests,
-      mcp: {
-        token: pre.jobToken.token,
-        expiresAt: pre.jobToken.expires_at ? Date.parse(pre.jobToken.expires_at) || null : null,
-        projectSlug: pre.projectSlug,
-        branch: job.archme_branch
-      }
-    });
-    const cloneIn = await writeInput("clone", {
-      kind: "clone",
-      job: sjob,
-      marker: pre.marker,
-      credentials: {
-        https_url: pre.credentials.https_url,
-        username: pre.credentials.username,
-        password: pre.credentials.password
-      }
-    });
-    const clone = await runBox(spec("clone", "nat", deps.cloneBoxEnv(), cloneIn.dir), t.cloneMs);
-    await cloneIn.cleanup();
-    if (clone.kind === "refused") return failed("clone", clone.reason);
-    sandbox.clone_ms = clone.ms;
-    sandbox.box_ms += clone.ms;
-    durations.sandbox_clone = clone.ms;
-    if (clone.killCause) return failed("clone", clone.killCause, clone.exit.stderr);
-    const cp = deps.parseResultLine(clone.exit.stdout, clone.exit.nonce);
-    if (!cp.ok || cp.result.kind !== "clone") {
-      deps.log(`clone result line: ${cp.ok ? `unexpected kind ${cp.result.kind}` : cp.reason}`);
-      return failed("clone", "result_malformed", clone.exit.stderr);
-    }
-    const cr = cp.result;
-    sandbox.memory_peak_bytes.clone = cr.memoryPeakBytes;
-    for (const [k, v] of Object.entries(cr.durations_ms ?? {})) durations[`clone_${k}`] = v;
-    if (cr.outcome === "skip") return { kind: "skip", metrics };
-    if (cr.outcome === "rejected") return { kind: "rejected", message: cr.error ?? "job rejected by the clone step", metrics };
-    if (cr.error || clone.exit.exitCode !== 0 || !cr.diff) {
-      return failed("clone", cr.error ?? `clone step exited ${clone.exit.exitCode}`, clone.exit.stderr);
-    }
-    Object.assign(metrics, {
-      mode: job.source_mode === "pr_update" ? "pr_update" : "diff",
-      files: cr.diff.files,
-      bytes: cr.diff.bytes,
-      materialized: cr.diff.materialized,
-      range: cr.diff.rangeLabel,
-      model: pre.model
-    });
-    const claudeMs = cr.diff.materialized ? t.largeDiffClaudeMs : t.claudeMs;
-    const agentIn = await writeInput("agent", {
-      kind: "agent",
-      job: sjob,
-      projectSlug: pre.projectSlug,
-      seedArch: pre.seedArch,
-      repoScope: pre.repoScope,
-      repoContainer: pre.repoContainer,
-      bugsFolderId: pre.bugsFolderId,
-      model: pre.model,
-      timeoutMs: claudeMs,
-      gateway: slot.gateway
-    });
-    const agent = await runBox(spec("agent", slot, deps.agentBoxEnv(slot.gateway), agentIn.dir), claudeMs + t.graceMs);
-    await agentIn.cleanup();
-    if (agent.kind === "refused") return failed("agent", agent.reason);
-    sandbox.box_ms += agent.ms;
-    durations.sandbox_agent = agent.ms;
-    readCounters();
-    if (agent.killCause) return failed("agent", agent.killCause, agent.exit.stderr);
-    const ap = deps.parseResultLine(agent.exit.stdout, agent.exit.nonce);
-    if (!ap.ok || ap.result.kind !== "agent") {
-      deps.log(`agent result line: ${ap.ok ? `unexpected kind ${ap.result.kind}` : ap.reason}`);
-      return failed("agent", "result_malformed", agent.exit.stderr);
-    }
-    const ar = ap.result;
-    sandbox.memory_peak_bytes.agent = ar.memoryPeakBytes;
-    for (const [k, v] of Object.entries(ar.durations_ms ?? {})) durations[`agent_${k}`] = v;
-    if (ar.seed) metrics.seed = ar.seed;
-    if (ar.error) return failed("agent", ar.error, agent.exit.stderr);
+    // Verified: `:ro` on a directory bind is a read-only virtiofs mount — even
+    // root in the box gets EROFS on create/mkdir.
+    "-v",
+    `${spec.inputDir}:/job:ro`,
+    ...spec.volume !== void 0 ? ["-v", `${spec.volume}:/work`] : [],
+    ...envArgs(spec.env),
+    spec.image,
+    ...spec.args
+  ];
+}
+function buildInitVolumeArgs(volume, uid, labels, image, slot) {
+  assertName("volume", volume);
+  assertImage(image);
+  const network = slotNetwork(slot);
+  if (!Number.isInteger(uid) || uid <= 0) throw new Error(`sandbox: invalid uid ${uid}`);
+  return [
+    "run",
+    "--rm",
+    "--init",
+    "--read-only",
+    "--cap-drop",
+    "ALL",
+    "--cap-add",
+    "CHOWN",
+    "--user",
+    "0:0",
+    "--no-dns",
+    "--kernel-arg",
+    "ipv6.disable=1",
+    "--progress",
+    "none",
+    "--network",
+    network,
+    "--memory",
+    `${INIT_MEMORY_MIB}M`,
+    ...labelArgs(labels),
+    "-v",
+    `${volume}:/work`,
+    "--entrypoint",
+    "chown",
+    image,
+    `${uid}:${uid}`,
+    "/work"
+  ];
+}
+function buildCreateVolumeArgs(name, sizeGiB, labels) {
+  assertName("volume", name);
+  if (!Number.isInteger(sizeGiB) || sizeGiB < 1) throw new Error(`sandbox: invalid volume size ${sizeGiB}`);
+  return ["volume", "create", "-s", `${sizeGiB}G`, ...labelArgs(labels), name];
+}
+function buildEnsureNetworkArgs(slot) {
+  return [
+    "network",
+    "create",
+    "--internal",
+    "--subnet",
+    slot.subnet,
+    "--label",
+    `${SLOT_LABEL}=${slot.index}`,
+    slot.network
+  ];
+}
+function labelsOf(v) {
+  const out = {};
+  for (const [k, x] of Object.entries(obj(v))) if (typeof x === "string") out[k] = x;
+  return out;
+}
+function parseArray(json, what) {
+  const parsed = JSON.parse(json.trim() || "[]");
+  if (!Array.isArray(parsed)) throw new Error(`sandbox: ${what} is not a JSON array`);
+  return parsed;
+}
+function parseBoxList(json) {
+  return parseArray(json, "container ls").flatMap((raw) => {
+    const r = obj(raw);
+    const id = str(r.id) ?? str(obj(r.configuration).id);
+    if (!id) return [];
+    return [{ id, state: str(obj(r.status).state) ?? "unknown", labels: labelsOf(obj(r.configuration).labels) }];
+  });
+}
+function parseVolumeList(json) {
+  return parseArray(json, "container volume ls").flatMap((raw) => {
+    const r = obj(raw);
+    const name = str(obj(r.configuration).name) ?? str(r.id);
+    if (!name) return [];
+    return [{ name, labels: labelsOf(obj(r.configuration).labels) }];
+  });
+}
+function parseNetworkList(json) {
+  return parseArray(json, "container network ls").flatMap((raw) => {
+    const r = obj(raw);
+    const c3 = obj(r.configuration);
+    const name = str(c3.name) ?? str(r.id);
+    if (!name) return [];
+    return [{
+      name,
+      subnet: str(c3.ipv4Subnet) ?? str(obj(r.status).ipv4Subnet),
+      mode: str(c3.mode),
+      labels: labelsOf(c3.labels)
+    }];
+  });
+}
+function isBoxNotFound(stderr) {
+  return /notFound: "container with ID .* not found"/.test(stderr);
+}
+function isBoxStopped(stderr) {
+  return /invalidState: "no runtime client exists: container is stopped"/.test(stderr);
+}
+function defaultExec2(bin = "container") {
+  return async (args) => {
+    const r = await execa(bin, args, { reject: false, stdin: "ignore" });
+    const stderr = typeof r.stderr === "string" ? r.stderr : "";
     return {
-      kind: "claude",
-      exitCode: ar.exitCode,
-      signal: ar.signal,
-      claudeStdout: ar.claudeStdout,
-      stderr: agent.exit.stderr,
-      affected: ar.affected,
-      metrics
+      exitCode: r.exitCode ?? -1,
+      stdout: typeof r.stdout === "string" ? r.stdout : "",
+      stderr: r.exitCode === void 0 ? `${stderr}
+${r.message}`.trim() : stderr
     };
   };
-  try {
-    const pre = await deps.prefetch(job);
-    try {
-      return await runBoxes(pre);
-    } catch (e) {
-      if (e instanceof SandboxInfraError) throw e;
-      throw new SandboxInfraError(e instanceof Error ? e.message : String(e), agentStarted);
-    }
-  } finally {
-    const step = async (what, fn) => {
-      try {
-        await fn();
-      } catch (e) {
-        deps.log(`sandbox cleanup (${what}) failed: ${e.message}`);
-      }
+}
+function defaultSpawn(bin = "container") {
+  return (args) => {
+    const p = execa(bin, args, { reject: false, stdin: "pipe", buffer: false });
+    return {
+      stdin: p.stdin,
+      stdout: p.stdout,
+      stderr: p.stderr,
+      exited: p.then((r) => ({
+        exitCode: r.exitCode ?? null,
+        signal: r.signal ?? null,
+        error: r.exitCode === void 0 && !r.signal ? r.message : void 0
+      }))
     };
-    for (const name of liveBoxes) await step(`kill ${name}`, () => deps.runtime.kill(name));
-    if (volumeTouched) await step("remove volume", () => deps.runtime.removeVolume(volume));
-    await step("counters", readCounters);
-    await step("clear gates", () => deps.gates.clearJob(slot));
-    await step("free slot", () => deps.pool.free(slot.index));
-    for (const c3 of inputCleanups) await step("input dir", c3);
-    await step("release", () => deps.registry.release(job.id));
-  }
+  };
 }
-var DEFAULT_SANDBOX_TIMEOUTS, SandboxInfraError;
-var init_runSandboxedJob = __esm({
-  "src/daemon/sandbox/runSandboxedJob.ts"() {
+var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, obj, str, TailBuffer, AppleContainerRuntime;
+var init_appleContainer = __esm({
+  "src/daemon/sandbox/appleContainer.ts"() {
     "use strict";
+    init_execa();
+    init_sweep();
     init_types();
-    DEFAULT_SANDBOX_TIMEOUTS = {
-      claudeMs: 30 * 60 * 1e3,
-      largeDiffClaudeMs: 45 * 60 * 1e3,
-      graceMs: 2 * 60 * 1e3,
-      cloneMs: 10 * 60 * 1e3
-    };
-    SandboxInfraError = class extends Error {
-      constructor(message2, agentStarted) {
-        super(message2);
-        this.agentStarted = agentStarted;
-        this.name = "SandboxInfraError";
-      }
-    };
-  }
-});
-
-// src/daemon/sandbox/classifySandboxExit.ts
-function classifySandboxExit(input) {
-  const { counters, exitCode, stderr, stepFailure } = input;
-  if ((counters?.cap_hits ?? 0) > 0 || stderr.includes(SANDBOX_CAP_BODY)) {
-    return {
-      kind: "terminal",
-      reason: SANDBOX_REQUEST_CAP_REASON,
-      message: `${SANDBOX_REQUEST_CAP_REASON}: the job exceeded the sandbox model-request cap` + (counters ? ` (${counters.model_requests} requests, ${counters.cap_hits} refused)` : "")
+    MIN_MEMORY_MIB = 200;
+    STDOUT_CAP_BYTES = 4 * 1024 * 1024;
+    STDERR_CAP_BYTES = 1024 * 1024;
+    INIT_MEMORY_MIB = 256;
+    NAME_RE = /^[a-z0-9][a-z0-9_.-]*$/;
+    ENV_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
+    LABEL_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+    CONTROL_RE = /[\u0000\n\r]/;
+    obj = (v) => v && typeof v === "object" ? v : {};
+    str = (v) => typeof v === "string" ? v : null;
+    TailBuffer = class {
+      constructor(cap) {
+        this.cap = cap;
+      }
+      chunks = [];
+      size = 0;
+      truncated = false;
+      push(chunk) {
+        this.chunks.push(chunk);
+        this.size += chunk.length;
+        while (this.size > this.cap && this.chunks.length > 0) {
+          const head = this.chunks[0];
+          const over = this.size - this.cap;
+          this.truncated = true;
+          if (head.length <= over) {
+            this.chunks.shift();
+            this.size -= head.length;
+          } else {
+            this.chunks[0] = head.subarray(over);
+            this.size -= over;
+          }
+        }
+      }
+      toString() {
+        let buf = Buffer.concat(this.chunks);
+        if (this.truncated) {
+          let i2 = 0;
+          while (i2 < buf.length && i2 < 3 && (buf[i2] & 192) === 128) i2++;
+          buf = buf.subarray(i2);
+        }
+        return buf.toString("utf8");
+      }
+    };
+    AppleContainerRuntime = class {
+      constructor(opts = {}) {
+        this.opts = opts;
+        this.exec = opts.exec ?? defaultExec2(opts.bin);
+        this.spawn = opts.spawn ?? defaultSpawn(opts.bin);
+      }
+      name = "apple-container";
+      exec;
+      spawn;
+      /** Boxes `kill()` was called for while their step was running. */
+      killedNames = /* @__PURE__ */ new Set();
+      running = /* @__PURE__ */ new Set();
+      async must(args, what) {
+        const r = await this.exec(args);
+        if (r.exitCode !== 0) throw new Error(`sandbox: ${what} failed (exit ${r.exitCode}): ${r.stderr.trim()}`);
+        return r;
+      }
+      async preflight() {
+        const checks = [];
+        const status = await this.exec(["system", "status"]);
+        const up = status.exitCode === 0 && /^status\s+running\b/m.test(status.stdout);
+        checks.push({ name: "runtime_status", ok: up, detail: up ? void 0 : (status.stderr || status.stdout).trim() });
+        if (this.opts.image) {
+          let img = await this.exec(["image", "inspect", this.opts.image]);
+          if (img.exitCode !== 0 && up && this.opts.image.includes("@sha256:")) {
+            const pull = await this.exec(["image", "pull", this.opts.image]);
+            img = pull.exitCode === 0 ? await this.exec(["image", "inspect", this.opts.image]) : pull;
+          }
+          checks.push({ name: "image_present", ok: img.exitCode === 0, detail: img.exitCode === 0 ? void 0 : img.stderr.trim() });
+        } else {
+          checks.push({ name: "image_present", ok: false, detail: "no image configured" });
+        }
+        const want = this.opts.slots ?? 0;
+        if (up) {
+          const nets = await this.listNetworks();
+          const missing = [];
+          for (let i2 = 0; i2 < want; i2++) {
+            const s = slotFor(i2);
+            const n2 = nets.find((x) => x.name === s.network);
+            if (!n2 || n2.subnet !== s.subnet) missing.push(n2 ? `${s.network} (subnet ${n2.subnet})` : s.network);
+          }
+          checks.push({ name: "slot_networks", ok: missing.length === 0, detail: missing.length ? `missing/wrong: ${missing.join(", ")}` : void 0 });
+        } else {
+          checks.push({ name: "slot_networks", ok: false, detail: "runtime not running" });
+        }
+        return { ok: checks.every((c3) => c3.ok), checks };
+      }
+      async listNetworks() {
+        const r = await this.must(["network", "ls", "--format", "json"], "network ls");
+        return parseNetworkList(r.stdout);
+      }
+      async ensureSlots(n2) {
+        if (!Number.isInteger(n2) || n2 < 1 || n2 > MAX_SLOTS) throw new Error(`sandbox: slot count out of range: ${n2}`);
+        const slots = Array.from({ length: n2 }, (_, i2) => slotFor(i2));
+        let nets = await this.listNetworks();
+        for (const s of slots) {
+          const existing = nets.find((x) => x.name === s.network);
+          if (existing) {
+            if (existing.subnet !== s.subnet) {
+              throw new Error(`sandbox: ${s.network} exists with subnet ${existing.subnet}, expected ${s.subnet}`);
+            }
+            continue;
+          }
+          const r = await this.exec(buildEnsureNetworkArgs(s));
+          if (r.exitCode !== 0) {
+            nets = await this.listNetworks();
+            const now = nets.find((x) => x.name === s.network);
+            if (!now || now.subnet !== s.subnet) {
+              throw new Error(`sandbox: creating ${s.network} failed: ${r.stderr.trim()}`);
+            }
+          }
+        }
+        return slots;
+      }
+      async createVolume(name, sizeGiB, labels) {
+        await this.must(buildCreateVolumeArgs(name, sizeGiB, labels), `volume create ${name}`);
+      }
+      async initVolume(name, uid, labels, image, slot) {
+        await this.must(buildInitVolumeArgs(name, uid, labels, image, slot), `volume init ${name}`);
+      }
+      async runStep(spec) {
+        const args = buildRunArgs(spec, this.opts.homeDir);
+        const name = spec.name;
+        this.running.add(name);
+        this.killedNames.delete(name);
+        const out = new TailBuffer(STDOUT_CAP_BYTES);
+        const err4 = new TailBuffer(STDERR_CAP_BYTES);
+        const nonce = randomBytes2(16).toString("hex");
+        const proc = this.spawn(args);
+        if (proc.stdin) {
+          proc.stdin.on("error", () => {
+          });
+          proc.stdin.end(`${nonce}
+`);
+        }
+        const tee = (stream, buf, which) => new Promise((resolve7) => {
+          if (!stream) return resolve7();
+          stream.on("data", (c3) => {
+            const b = typeof c3 === "string" ? Buffer.from(c3) : c3;
+            buf.push(b);
+            this.opts.onOutput?.(name, which, b);
+          });
+          stream.on("end", () => resolve7());
+          stream.on("close", () => resolve7());
+          stream.on("error", () => resolve7());
+        });
+        const done = (async () => {
+          const [exit] = await Promise.all([proc.exited, tee(proc.stdout, out, "stdout"), tee(proc.stderr, err4, "stderr")]);
+          const killed = this.killedNames.has(name);
+          this.killedNames.delete(name);
+          this.running.delete(name);
+          const stderr = err4.toString();
+          return {
+            exitCode: exit.exitCode,
+            signal: exit.signal,
+            stdout: out.toString(),
+            stderr: exit.error ? `${stderr}
+${exit.error}`.trim() : stderr,
+            killed,
+            nonce
+          };
+        })();
+        return { name, done };
+      }
+      /** Not-found and already-stopped both count as success: the box is not running. */
+      async kill(name) {
+        assertName("box", name);
+        if (this.running.has(name)) this.killedNames.add(name);
+        const r = await this.exec(["kill", name]);
+        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr) && !isBoxStopped(r.stderr)) {
+          throw new Error(`sandbox: kill ${name} failed: ${r.stderr.trim()}`);
+        }
+      }
+      async stop(name, graceSeconds) {
+        assertName("box", name);
+        const t = Math.max(0, Math.floor(graceSeconds));
+        const r = await this.exec(["stop", "-t", String(t), name]);
+        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr) && !isBoxStopped(r.stderr)) {
+          throw new Error(`sandbox: stop ${name} failed: ${r.stderr.trim()}`);
+        }
+      }
+      /** `container rm`; not-found counts as removed (a `--rm` box is gone once stopped). */
+      async remove(name) {
+        assertName("box", name);
+        const r = await this.exec(["rm", name]);
+        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr)) {
+          throw new Error(`sandbox: rm ${name} failed: ${r.stderr.trim()}`);
+        }
+      }
+      async removeVolume(name) {
+        assertName("volume", name);
+        const r = await this.exec(["volume", "rm", name]);
+        if (r.exitCode === 0) return;
+        const still = (await this.listVolumes()).some((v) => v.name === name);
+        if (still) throw new Error(`sandbox: volume rm ${name} failed: ${r.stderr.trim()}`);
+      }
+      async list() {
+        const r = await this.must(["ls", "-a", "--format", "json"], "ls");
+        return parseBoxList(r.stdout);
+      }
+      async listVolumes() {
+        const r = await this.must(["volume", "ls", "--format", "json"], "volume ls");
+        return parseVolumeList(r.stdout);
+      }
+      sweep() {
+        return sweepJobs(this);
+      }
     };
   }
-  if (stepFailure == null && exitCode !== null && exitCode !== 0 && counters?.last_upstream_status === 429) {
-    return { kind: "upstream_rate_limit" };
+});
+
+// src/daemon/sandbox/slotMap.ts
+function parseIpv4(addr) {
+  const m = IPV4_RE.exec(addr);
+  if (!m) return null;
+  let v = 0;
+  for (let i2 = 1; i2 <= 4; i2++) {
+    const o2 = Number(m[i2]);
+    if (o2 > 255) return null;
+    v = v * 256 + o2;
   }
-  return { kind: "normal" };
+  return v >>> 0;
 }
-function routeSandboxFailure(verdict, planFor, nowMs = Date.now()) {
-  if (verdict?.kind === "terminal") return { kind: "terminal", message: verdict.message };
-  const plan = planFor();
-  if (plan) return { kind: "defer", plan };
-  if (verdict?.kind === "upstream_rate_limit") {
-    return {
-      kind: "defer",
-      plan: { parsed: false, pauseUntil: new Date(nowMs + RATE_LIMIT_TENTATIVE_PAUSE_MS), info: null }
-    };
-  }
-  return { kind: "fail" };
+function parseCidr(cidr) {
+  const [ip, bits, extra] = cidr.split("/");
+  if (ip === void 0 || bits === void 0 || extra !== void 0 || !/^\d{1,2}$/.test(bits)) return null;
+  const n2 = Number(bits);
+  const base = parseIpv4(ip);
+  if (base === null || n2 > 32) return null;
+  const mask2 = n2 === 0 ? 0 : ~0 << 32 - n2 >>> 0;
+  return { base: (base & mask2) >>> 0, mask: mask2 };
 }
-var SANDBOX_REQUEST_CAP_REASON, SandboxExitError;
-var init_classifySandboxExit = __esm({
-  "src/daemon/sandbox/classifySandboxExit.ts"() {
+function stripMapped(addr) {
+  return (addr ?? "").replace(/^::ffff:/i, "");
+}
+var IPV4_RE, SlotMap;
+var init_slotMap = __esm({
+  "src/daemon/sandbox/slotMap.ts"() {
     "use strict";
-    init_rateLimit();
-    init_types();
-    SANDBOX_REQUEST_CAP_REASON = "sandbox_request_cap";
-    SandboxExitError = class extends Error {
-      constructor(message2, verdict) {
-        super(message2);
-        this.verdict = verdict;
-        this.name = "SandboxExitError";
+    init_appleContainer();
+    IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+    SlotMap = class {
+      byIndex = /* @__PURE__ */ new Map();
+      byGateway = /* @__PURE__ */ new Map();
+      allowGatewayAsPeer;
+      constructor(slots, opts = {}) {
+        this.allowGatewayAsPeer = opts.allowGatewayAsPeer ?? false;
+        for (const slot of slots) {
+          const gateway = parseIpv4(slot.gateway);
+          const cidr = parseCidr(slot.subnet);
+          if (gateway === null) throw new Error(`slot ${slot.index}: gateway is not an IPv4 address`);
+          if (cidr === null) throw new Error(`slot ${slot.index}: subnet is not an IPv4 CIDR`);
+          if (this.byIndex.has(slot.index)) throw new Error(`slot ${slot.index}: duplicate index`);
+          if (this.byGateway.has(slot.gateway)) throw new Error(`slot ${slot.index}: duplicate gateway`);
+          const entry = { slot, gateway, cidr, binding: null };
+          this.byIndex.set(slot.index, entry);
+          this.byGateway.set(slot.gateway, entry);
+        }
+      }
+      /**
+       * The slot a connection belongs to, or null (drop it). `local` must be a slot
+       * gateway; `remote` must be a plain IPv4 inside THAT slot's subnet — never
+       * IPv6, never another slot's range.
+       */
+      resolve(localAddress, remoteAddress) {
+        const entry = this.byGateway.get(stripMapped(localAddress));
+        if (!entry) return null;
+        const remoteStr = stripMapped(remoteAddress);
+        const remote = parseIpv4(remoteStr);
+        if (remote === null) return null;
+        if ((remote & entry.cidr.mask) >>> 0 !== entry.cidr.base) return null;
+        if (remote === entry.gateway && !this.allowGatewayAsPeer) return null;
+        return entry.slot;
+      }
+      slots() {
+        return [...this.byIndex.values()].map((e) => e.slot);
+      }
+      slot(index) {
+        return this.byIndex.get(index)?.slot ?? null;
+      }
+      bind(index, binding) {
+        const entry = this.entry(index);
+        if (entry.binding && entry.binding.jobId !== binding.jobId) {
+          throw new Error(`slot ${index} is bound to another job`);
+        }
+        entry.binding = binding;
+      }
+      clear(index) {
+        this.entry(index).binding = null;
+      }
+      binding(index) {
+        return this.byIndex.get(index)?.binding ?? null;
+      }
+      bindingForJob(jobId) {
+        for (const e of this.byIndex.values()) {
+          if (e.binding?.jobId === jobId) return { slot: e.slot, binding: e.binding };
+        }
+        return null;
+      }
+      entry(index) {
+        const e = this.byIndex.get(index);
+        if (!e) throw new Error(`unknown slot ${index}`);
+        return e;
       }
     };
   }
 });
 
-// src/daemon/sandbox/sweep.ts
-async function sweepJobs(deps) {
-  const now = deps.now ?? Date.now;
-  const t0 = now();
+// src/daemon/sandbox/confinement.ts
+import { randomBytes as randomBytes3 } from "node:crypto";
+function probeTargets(slot, lanIp) {
+  const gw = slot.gateway;
+  return [
+    ...HOST_SERVICE_PORTS.map((port) => ({ id: `host_${port}`, kind: "tcp", host: gw, port })),
+    ...lanIp ? LAN_PORTS.map((port) => ({ id: `lan_${port}`, kind: "tcp", host: lanIp, port })) : [],
+    { id: "public_443", kind: "tcp", host: PUBLIC_PROBE_IP, port: 443 },
+    { id: "public_dns", kind: "udp_dns", host: PUBLIC_PROBE_IP, port: 53 },
+    { id: "ipv6", kind: "ipv6_socket", host: "::", port: 0 },
+    { id: "gate_anthropic", kind: "http", host: gw, port: GATE_PORTS.anthropic },
+    { id: "gate_mcp", kind: "http", host: gw, port: GATE_PORTS.mcp },
+    { id: "gate_github", kind: "connect", host: gw, port: GATE_PORTS.github }
+  ];
+}
+function expectation(id) {
+  if (id.startsWith("host_") || id.startsWith("lan_")) return { want: "timeout", ok: (o2) => o2 === "timeout" };
+  if (id === "public_dns") return { want: "silent", ok: (o2) => o2 === "silent" };
+  if (id.startsWith("public_")) return { want: "not connected", ok: (o2) => o2 !== "connected" };
+  if (id === "ipv6") return { want: "unsupported", ok: (o2) => o2 === "unsupported" };
+  if (id.startsWith("gate_")) return { want: "an HTTP status", ok: (o2) => /^\d{3}$/.test(o2) };
+  return { want: "a known target", ok: () => false };
+}
+function judgeProbe(outcomes, targets) {
+  const ids = targets ? targets.map((t) => t.id) : Object.keys(outcomes);
+  for (const id of ["host_22", "public_443", "public_dns", "ipv6", "gate_anthropic", "gate_mcp", "gate_github"]) {
+    if (!ids.includes(id)) ids.push(id);
+  }
   const failures = [];
-  const boxes = [];
-  const volumes = [];
-  const jobBoxes = (await deps.list()).filter(isJobBox);
-  await Promise.all(jobBoxes.map(async (b) => {
-    try {
-      await deps.kill(b.id).catch(() => void 0);
-      await deps.remove(b.id);
-      boxes.push(b.id);
-    } catch (e) {
-      failures.push(`box ${b.id}: ${e.message}`);
+  for (const id of ids) {
+    const o2 = outcomes[id];
+    const e = expectation(id);
+    if (o2 === void 0) failures.push(`${id}: no outcome (want: ${e.want})`);
+    else if (!e.ok(o2)) failures.push(`${id}: ${o2} (want: ${e.want})`);
+  }
+  return { ok: failures.length === 0, failures };
+}
+function primaryLanIpv4(ifaces) {
+  const lo = parseIpv4(`192.168.${SLOT_RANGE_BASE_THIRD_OCTET}.0`);
+  for (const list2 of Object.values(ifaces)) {
+    for (const i2 of list2 ?? []) {
+      if (i2.internal || i2.family !== "IPv4") continue;
+      const v = parseIpv4(i2.address);
+      if (v === null || (v & 4294965248) >>> 0 === lo) continue;
+      return i2.address;
     }
-  }));
-  const jobVolumes = (await deps.listVolumes()).filter(isJobVolume);
-  for (const v of jobVolumes) {
-    try {
-      await deps.removeVolume(v.name);
-      volumes.push(v.name);
-    } catch (e) {
-      failures.push(`volume ${v.name}: ${e.message}`);
+  }
+  return null;
+}
+async function runProbeBox(deps, slot, targets, targetTimeoutMs = TARGET_TIMEOUT_MS) {
+  const id = randomBytes3(6).toString("hex");
+  const name = `archme-probe-${id}`;
+  const input = { kind: "probe", targets, timeoutMs: targetTimeoutMs };
+  let cleanup = null;
+  let timer;
+  try {
+    const dir = await (deps.writeInputDir ?? writeInputDir)("probe", input);
+    cleanup = dir.cleanup;
+    const handle = await deps.runtime.runStep({
+      name,
+      image: deps.image,
+      args: ["probe"],
+      network: slot,
+      env: {},
+      inputDir: dir.dir,
+      limits: { cpus: 1, memoryMiB: 256 },
+      labels: { [JOB_LABEL]: `probe-${id}`, [SLOT_LABEL]: String(slot.index) }
+    });
+    const timeout = new Promise((r) => {
+      timer = setTimeout(() => r("timeout"), deps.boxTimeoutMs ?? 6e4);
+    });
+    const exit = await Promise.race([handle.done, timeout]);
+    if (exit === "timeout") return { outcomes: {}, error: "probe box timed out" };
+    const parsed = (deps.parseResultLine ?? parseResultLine)(exit.stdout, exit.nonce);
+    if (!parsed.ok || parsed.result.kind !== "probe") {
+      return { outcomes: {}, error: `probe result: ${parsed.ok ? `unexpected kind ${parsed.result.kind}` : parsed.reason}` };
     }
+    return { outcomes: parsed.result.outcomes, error: parsed.result.error ? `probe box: ${parsed.result.error}` : null };
+  } catch (e) {
+    return { outcomes: {}, error: `probe box failed: ${e.message}` };
+  } finally {
+    clearTimeout(timer);
+    await deps.runtime.kill(name).catch((e) => deps.log?.(`kill ${name} failed: ${e.message}`));
+    await cleanup?.();
   }
-  const report = { boxes: boxes.sort(), volumes, ms: now() - t0 };
-  if (failures.length > 0) throw new SweepError(report, failures);
-  return report;
 }
-var JOB_VOLUME_PREFIX, SweepError, isJobBox, isJobVolume;
-var init_sweep = __esm({
-  "src/daemon/sandbox/sweep.ts"() {
+async function runConfinementProbe(deps, slot, lanIp) {
+  const now = deps.now ?? Date.now;
+  const started = now();
+  const targets = probeTargets(slot, lanIp);
+  const { outcomes, error } = await runProbeBox(deps, slot, targets);
+  const j = judgeProbe(outcomes, targets);
+  const failures = error ? [error, ...Object.keys(outcomes).length ? j.failures : []] : j.failures;
+  return { ok: !error && j.ok, slot: slot.index, failures, outcomes, ms: now() - started };
+}
+function formatConfinementReport(r) {
+  return r.ok ? `confinement probe passed on slot ${r.slot} (${r.ms}ms)` : `confinement probe failed on slot ${r.slot}: ${r.failures.join("; ")}`;
+}
+var PUBLIC_PROBE_IP, HOST_SERVICE_PORTS, LAN_PORTS, TARGET_TIMEOUT_MS, CONFINEMENT_PROBE_INTERVAL_MS, CONFINEMENT_RETRY_MS, realTimers, ConfinementMonitor;
+var init_confinement = __esm({
+  "src/daemon/sandbox/confinement.ts"() {
     "use strict";
+    init_result2();
+    init_inputDir();
+    init_slotMap();
     init_types();
-    JOB_VOLUME_PREFIX = "archme-job-";
-    SweepError = class extends Error {
-      constructor(report, failures) {
-        super(`sandbox sweep left ${failures.length} item(s): ${failures.join("; ")}`);
-        this.report = report;
-        this.failures = failures;
-        this.name = "SweepError";
+    PUBLIC_PROBE_IP = "1.1.1.1";
+    HOST_SERVICE_PORTS = [22, 88, 5e3, 7e3];
+    LAN_PORTS = [22, 5e3];
+    TARGET_TIMEOUT_MS = 2e3;
+    CONFINEMENT_PROBE_INTERVAL_MS = 60 * 60 * 1e3;
+    CONFINEMENT_RETRY_MS = 5 * 60 * 1e3;
+    realTimers = {
+      setTimeout: (fn, ms) => {
+        const t = setTimeout(fn, ms);
+        t.unref?.();
+        return t;
+      },
+      clearTimeout: (h2) => clearTimeout(h2)
+    };
+    ConfinementMonitor = class {
+      constructor(opts) {
+        this.opts = opts;
+        this.timers = opts.timers ?? realTimers;
+      }
+      timers;
+      handle = null;
+      failing = false;
+      probing = false;
+      stopped = false;
+      /** The boot probe already ran; the next is an hour out. */
+      start() {
+        this.stopped = false;
+        this.schedule(CONFINEMENT_PROBE_INTERVAL_MS);
+      }
+      stop() {
+        this.stopped = true;
+        if (this.handle !== null) this.timers.clearTimeout(this.handle);
+        this.handle = null;
+      }
+      allowsClaims() {
+        return this.opts.mode !== "required" || !this.failing && !this.probing;
+      }
+      schedule(ms) {
+        if (this.stopped) return;
+        if (this.handle !== null) this.timers.clearTimeout(this.handle);
+        this.handle = this.timers.setTimeout(() => {
+          this.handle = null;
+          void this.runOnce();
+        }, ms);
+      }
+      async runOnce() {
+        const slot = this.opts.pool.lease();
+        if (!slot) {
+          this.opts.log("confinement probe: no free slot, retrying in 5 minutes");
+          return this.schedule(CONFINEMENT_RETRY_MS);
+        }
+        this.probing = true;
+        let report;
+        try {
+          report = await this.opts.probe(slot);
+        } catch (e) {
+          report = { ok: false, slot: slot.index, failures: [`probe threw: ${e.message}`], outcomes: {}, ms: 0 };
+        } finally {
+          this.opts.pool.free(slot.index);
+          this.probing = false;
+        }
+        this.opts.log(formatConfinementReport(report));
+        if (report.ok) {
+          if (this.failing) this.opts.log("confinement holds again; claiming resumes");
+          this.failing = false;
+          return this.schedule(CONFINEMENT_PROBE_INTERVAL_MS);
+        }
+        if (this.opts.mode === "required") {
+          if (!this.failing) this.opts.log("ARCHME_SANDBOX=required: not claiming jobs until confinement holds (re-probing every 5 minutes)");
+          this.failing = true;
+          return this.schedule(CONFINEMENT_RETRY_MS);
+        }
+        this.schedule(CONFINEMENT_PROBE_INTERVAL_MS);
       }
     };
-    isJobBox = (b) => JOB_LABEL in b.labels;
-    isJobVolume = (v) => v.name.startsWith(JOB_VOLUME_PREFIX) || JOB_LABEL in v.labels;
   }
 });
 
-// src/daemon/sandbox/appleContainer.ts
-import { randomBytes as randomBytes2 } from "node:crypto";
-import { homedir as homedir7 } from "node:os";
-import { isAbsolute, normalize } from "node:path";
-function assertName(kind, value) {
-  if (!NAME_RE.test(value)) throw new Error(`sandbox: invalid ${kind} name ${JSON.stringify(value)}`);
-}
-function assertImage(image) {
-  if (!image || image.startsWith("-") || /\s/.test(image)) {
-    throw new Error(`sandbox: invalid image ${JSON.stringify(image)}`);
+// src/daemon/sandbox/claudeToken.ts
+import { constants as fsConstants } from "node:fs";
+import { chmod as chmod5, mkdir as mkdir11, open as open3 } from "node:fs/promises";
+import { dirname as dirname15 } from "node:path";
+function assertTokenShape(raw, where) {
+  const token = raw.trim();
+  if (!token) throw new SandboxBootError(`sandbox Claude token ${where} is empty`);
+  if (!/^[\x21-\x7e]+$/.test(token)) {
+    throw new SandboxBootError(`sandbox Claude token ${where} contains whitespace or control characters; save it as one line`);
   }
+  return token;
 }
-function labelArgs(labels) {
-  const out = [];
-  for (const [k, v] of Object.entries(labels)) {
-    if (!LABEL_KEY_RE.test(k)) throw new Error(`sandbox: invalid label key ${JSON.stringify(k)}`);
-    if (CONTROL_RE.test(v)) throw new Error(`sandbox: label ${k} value contains a control character`);
-    out.push("--label", `${k}=${v}`);
+async function readClaudeTokenFile(path7) {
+  let fh;
+  try {
+    fh = await open3(path7, fsConstants.O_RDONLY | fsConstants.O_NOFOLLOW);
+  } catch (e) {
+    throw new SandboxBootError(`cannot read the sandbox Claude token at ${path7}: ${e.message}`);
   }
-  return out;
-}
-function assertInputDir(dir, home2 = homedir7()) {
-  if (!isAbsolute(dir)) throw new Error(`sandbox: inputDir must be absolute: ${dir}`);
-  const strip2 = (p) => p.replace(/\/+$/, "") || "/";
-  const n2 = strip2(normalize(dir));
-  if (n2 !== strip2(dir)) throw new Error(`sandbox: inputDir must be normalized: ${dir}`);
-  if (/[:,]/.test(n2) || CONTROL_RE.test(n2)) throw new Error(`sandbox: inputDir has a forbidden character: ${dir}`);
-  const homeN = strip2(normalize(home2));
-  if (n2 === "/" || n2 === homeN || /^\/(Users|home)(\/[^/]+)?$/.test(n2) || n2 === "/root" || n2 === "/var/root") {
-    throw new Error(`sandbox: inputDir must not be / or a home directory: ${dir}`);
+  try {
+    const st = await fh.stat();
+    if (!st.isFile()) throw new SandboxBootError(`sandbox Claude token ${path7} is not a regular file`);
+    if ((st.mode & 63) !== 0) {
+      throw new SandboxBootError(
+        `sandbox Claude token ${path7} is readable by group or others (mode ${(st.mode & 511).toString(8)}); chmod 600 it`
+      );
+    }
+    return assertTokenShape(await fh.readFile("utf8"), path7);
+  } finally {
+    await fh.close();
   }
 }
-function envArgs(env) {
-  const out = [];
-  for (const [k, v] of Object.entries(env)) {
-    if (!ENV_KEY_RE.test(k)) throw new Error(`sandbox: invalid env key ${JSON.stringify(k)}`);
-    if (CONTROL_RE.test(v)) throw new Error(`sandbox: env ${k} value contains a newline or NUL`);
-    out.push("-e", `${k}=${v}`);
+async function readSandboxClaudeToken(settings, deps = {}) {
+  if (settings.claudeTokenOverride) {
+    return { token: await readClaudeTokenFile(settings.claudeTokenPath), source: "file-override" };
   }
-  return out;
-}
-function slotFor(index) {
-  if (!Number.isInteger(index) || index < 0 || index >= MAX_SLOTS) {
-    throw new Error(`sandbox: slot index out of range: ${index}`);
+  const keytar = await (deps.loadKeytar ?? loadKeytar)();
+  const stored = keytar ? await keytar.getPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT).catch(() => null) : null;
+  if (stored) return { token: assertTokenShape(stored, "in the keychain"), source: "keychain" };
+  try {
+    return { token: await readClaudeTokenFile(settings.claudeTokenPath), source: "file" };
+  } catch (e) {
+    throw new SandboxBootError(
+      `${e.message}; no token in the keychain either \u2014 run \`archme daemon sandbox setup\` to store one`
+    );
   }
-  const third = SLOT_RANGE_BASE_THIRD_OCTET + index;
-  return {
-    index,
-    network: `archme-slot-${index}`,
-    subnet: `192.168.${third}.0/24`,
-    gateway: `192.168.${third}.1`
-  };
 }
-function buildRunArgs(spec, home2) {
-  assertName("box", spec.name);
-  assertName("volume", spec.volume);
-  assertImage(spec.image);
-  assertInputDir(spec.inputDir, home2);
-  if (!spec.labels[JOB_LABEL]) throw new Error(`sandbox: step labels must include ${JOB_LABEL}`);
-  const { cpus, memoryMiB } = spec.limits;
-  if (!Number.isInteger(cpus) || cpus < 1) throw new Error(`sandbox: invalid cpus ${cpus}`);
-  if (!Number.isInteger(memoryMiB) || memoryMiB < MIN_MEMORY_MIB) {
-    throw new Error(`sandbox: memoryMiB must be an integer \u2265 ${MIN_MEMORY_MIB}: ${memoryMiB}`);
+async function storeSandboxClaudeToken(raw, opts) {
+  const token = assertTokenShape(raw, "(entered)");
+  let note;
+  const keytar = opts.override ? null : await (opts.loadKeytar ?? loadKeytar)();
+  if (opts.override) {
+    note = `ARCHME_SANDBOX_CLAUDE_TOKEN_FILE is set: ${opts.path}`;
+  } else if (keytar) {
+    try {
+      await keytar.setPassword(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT, token);
+      return { source: "keychain" };
+    } catch (e) {
+      note = `the keychain refused it (${e.message})`;
+    }
+  } else {
+    note = "no keychain access on this machine";
   }
-  const network = spec.network === "nat" ? NAT_NETWORK : spec.network.network;
-  assertName("network", network);
-  return [
-    // `-i`: stdin carries the per-step result nonce (one line, then EOF) to
-    // the wrapper — the only channel that is neither a file, env nor argv.
-    "run",
-    "-i",
-    "--rm",
-    "--init",
-    "--read-only",
-    "--cap-drop",
-    "ALL",
-    "--user",
-    `${BOX_UID}:${BOX_UID}`,
-    "--tmpfs",
-    "/tmp",
-    "--no-dns",
-    "--kernel-arg",
-    "ipv6.disable=1",
-    // Progress lines otherwise land on stderr ahead of the box's own output.
-    "--progress",
-    "none",
-    "--cpus",
-    String(cpus),
-    "--memory",
-    `${memoryMiB}M`,
-    "--name",
-    spec.name,
-    ...labelArgs(spec.labels),
-    "--network",
-    network,
-    // Verified: `:ro` on a directory bind is a read-only virtiofs mount — even
-    // root in the box gets EROFS on create/mkdir.
-    "-v",
-    `${spec.inputDir}:/job:ro`,
-    "-v",
-    `${spec.volume}:/work`,
-    ...envArgs(spec.env),
-    spec.image,
-    ...spec.args
-  ];
-}
-function buildInitVolumeArgs(volume, uid, labels, image) {
-  assertName("volume", volume);
-  assertImage(image);
-  if (!Number.isInteger(uid) || uid <= 0) throw new Error(`sandbox: invalid uid ${uid}`);
-  return [
-    "run",
-    "--rm",
-    "--init",
-    "--read-only",
-    "--cap-drop",
-    "ALL",
-    "--cap-add",
-    "CHOWN",
-    "--user",
-    "0:0",
-    "--no-dns",
-    "--kernel-arg",
-    "ipv6.disable=1",
-    "--progress",
-    "none",
-    "--network",
-    NAT_NETWORK,
-    "--memory",
-    `${INIT_MEMORY_MIB}M`,
-    ...labelArgs(labels),
-    "-v",
-    `${volume}:/work`,
-    "--entrypoint",
-    "chown",
-    image,
-    `${uid}:${uid}`,
-    "/work"
-  ];
-}
-function buildCreateVolumeArgs(name, sizeGiB, labels) {
-  assertName("volume", name);
-  if (!Number.isInteger(sizeGiB) || sizeGiB < 1) throw new Error(`sandbox: invalid volume size ${sizeGiB}`);
-  return ["volume", "create", "-s", `${sizeGiB}G`, ...labelArgs(labels), name];
-}
-function buildEnsureNetworkArgs(slot) {
-  return [
-    "network",
-    "create",
-    "--internal",
-    "--subnet",
-    slot.subnet,
-    "--label",
-    `${SLOT_LABEL}=${slot.index}`,
-    slot.network
-  ];
-}
-function labelsOf(v) {
-  const out = {};
-  for (const [k, x] of Object.entries(obj(v))) if (typeof x === "string") out[k] = x;
-  return out;
-}
-function parseArray(json, what) {
-  const parsed = JSON.parse(json.trim() || "[]");
-  if (!Array.isArray(parsed)) throw new Error(`sandbox: ${what} is not a JSON array`);
-  return parsed;
-}
-function parseBoxList(json) {
-  return parseArray(json, "container ls").flatMap((raw) => {
-    const r = obj(raw);
-    const id = str(r.id) ?? str(obj(r.configuration).id);
-    if (!id) return [];
-    return [{ id, state: str(obj(r.status).state) ?? "unknown", labels: labelsOf(obj(r.configuration).labels) }];
-  });
-}
-function parseVolumeList(json) {
-  return parseArray(json, "container volume ls").flatMap((raw) => {
-    const r = obj(raw);
-    const name = str(obj(r.configuration).name) ?? str(r.id);
-    if (!name) return [];
-    return [{ name, labels: labelsOf(obj(r.configuration).labels) }];
-  });
+  await mkdir11(dirname15(opts.path), { recursive: true, mode: 448 });
+  const fh = await open3(
+    opts.path,
+    fsConstants.O_WRONLY | fsConstants.O_CREAT | fsConstants.O_TRUNC | fsConstants.O_NOFOLLOW,
+    384
+  );
+  try {
+    await fh.writeFile(`${token}
+`);
+  } finally {
+    await fh.close();
+  }
+  await chmod5(opts.path, 384);
+  return { source: "file", note };
 }
-function parseNetworkList(json) {
-  return parseArray(json, "container network ls").flatMap((raw) => {
-    const r = obj(raw);
-    const c3 = obj(r.configuration);
-    const name = str(c3.name) ?? str(r.id);
-    if (!name) return [];
-    return [{
-      name,
-      subnet: str(c3.ipv4Subnet) ?? str(obj(r.status).ipv4Subnet),
-      mode: str(c3.mode),
-      labels: labelsOf(c3.labels)
-    }];
+var SandboxBootError, KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT;
+var init_claudeToken = __esm({
+  "src/daemon/sandbox/claudeToken.ts"() {
+    "use strict";
+    init_credentials();
+    SandboxBootError = class extends Error {
+      constructor(message2) {
+        super(message2);
+        this.name = "SandboxBootError";
+      }
+    };
+    KEYCHAIN_SERVICE = "archme-daemon";
+    KEYCHAIN_ACCOUNT = "sandbox-claude-token";
+  }
+});
+
+// src/daemon/sandbox/host.ts
+import { networkInterfaces } from "node:os";
+function sandboxBootFailurePolicy(mode) {
+  return mode === "shadow" ? "run_unboxed" : "refuse";
+}
+function shutdownKillTargets(boxedJobs2, registry) {
+  return [...boxedJobs2].filter((id) => registry.hasLiveBoxes(id));
+}
+async function bootSandbox(settings, parts, deps) {
+  const sweep = await parts.runtime.sweep();
+  const inputDirs = await (deps.sweepInputDirs ?? sweepInputDirs)();
+  deps.log(
+    `  sandbox: swept ${sweep.boxes.length} box(es), ${sweep.volumes.length} volume(s) in ${sweep.ms}ms, ${inputDirs} input dir(s)`
+  );
+  const slots = await parts.runtime.ensureSlots(settings.slots);
+  const pool = parts.makePool(slots);
+  const { token: claudeToken, source } = await (deps.readClaudeToken ?? ((s) => readSandboxClaudeToken(s)))(settings);
+  deps.log(`  sandbox: Claude token from ${source === "keychain" ? "the macOS keychain" : source === "file-override" ? `ARCHME_SANDBOX_CLAUDE_TOKEN_FILE (${settings.claudeTokenPath})` : settings.claudeTokenPath}`);
+  const allSlots = Array.from({ length: MAX_SLOTS }, (_, i2) => slotFor(i2));
+  const gates = await parts.startGates(allSlots, {
+    mcpBaseUrl: deps.mcpBaseUrl,
+    claudeToken,
+    remint: deps.remint,
+    log: deps.log
   });
+  let preflight;
+  try {
+    preflight = await parts.runtime.preflight();
+  } catch (e) {
+    await gates.close().catch(() => {
+    });
+    throw e;
+  }
+  if (!preflight.ok) {
+    await gates.close().catch(() => {
+    });
+    throw new SandboxBootError(`sandbox preflight failed: ${failedChecks(preflight)}`);
+  }
+  const probe = deps.probe ?? ((slot) => runConfinementProbe({ runtime: parts.runtime, image: settings.image, log: deps.log }, slot, primaryLanIpv4(networkInterfaces())));
+  let report;
+  try {
+    report = await probe(slots[0]);
+  } catch (e) {
+    report = { ok: false, slot: 0, failures: [`probe threw: ${e.message}`], outcomes: {}, ms: 0 };
+  }
+  preflight = {
+    ok: preflight.ok && report.ok,
+    checks: [...preflight.checks, { name: "confinement_probe", ok: report.ok, detail: report.ok ? void 0 : report.failures.join("; ") }]
+  };
+  deps.log(`  sandbox: ${formatConfinementReport(report)}`);
+  if (!report.ok) {
+    if (settings.mode === "required") {
+      await gates.close().catch(() => {
+      });
+      throw new SandboxBootError(`sandbox preflight failed: ${failedChecks(preflight)}`);
+    }
+    deps.log("  sandbox: shadow mode boots anyway; run `archme daemon sandbox setup` to install the confinement");
+  }
+  const monitor = new ConfinementMonitor({ mode: settings.mode, probe, pool, log: deps.log });
+  return {
+    host: { settings, runtime: parts.runtime, registry: parts.registry, gates, pool, io: parts.io },
+    sweep,
+    preflight,
+    monitor
+  };
 }
-function isBoxNotFound(stderr) {
-  return /notFound: "container with ID .* not found"/.test(stderr);
+function failedChecks(p) {
+  return p.checks.filter((c3) => !c3.ok).map((c3) => `${c3.name}${c3.detail ? ` (${c3.detail})` : ""}`).join(", ") || "unknown";
 }
-function isBoxStopped(stderr) {
-  return /invalidState: "no runtime client exists: container is stopped"/.test(stderr);
+var init_host = __esm({
+  "src/daemon/sandbox/host.ts"() {
+    "use strict";
+    init_confinement();
+    init_appleContainer();
+    init_claudeToken();
+    init_inputDir();
+    init_types();
+    init_claudeToken();
+  }
+});
+
+// src/daemon/sandbox/runSandboxedJob.ts
+function sandboxJobOf(job) {
+  return {
+    id: job.id,
+    project_id: job.project_id,
+    repo_owner: job.repo_owner,
+    repo_name: job.repo_name,
+    repo_branch: job.repo_branch,
+    archme_branch: job.archme_branch,
+    before_sha: job.before_sha,
+    after_sha: job.after_sha,
+    forced: job.forced,
+    pr_number: job.pr_number ?? null,
+    source_mode: job.source_mode,
+    commit_message: job.commit_message ?? null,
+    head_commit_timestamp: job.head_commit_timestamp ?? null,
+    author_name: job.author_name ?? null,
+    author_login: job.author_login ?? null
+  };
 }
-function defaultExec2(bin = "container") {
-  return async (args) => {
-    const r = await execa(bin, args, { reject: false, stdin: "ignore" });
-    const stderr = typeof r.stderr === "string" ? r.stderr : "";
-    return {
-      exitCode: r.exitCode ?? -1,
-      stdout: typeof r.stdout === "string" ? r.stdout : "",
-      stderr: r.exitCode === void 0 ? `${stderr}
-${r.message}`.trim() : stderr
+async function runSandboxedJob(deps, job, opts) {
+  const { slot } = opts;
+  const t = { ...DEFAULT_SANDBOX_TIMEOUTS, ...opts.timeouts };
+  const pollMs = opts.pollMs ?? 1e3;
+  const now = deps.now ?? Date.now;
+  const { settings } = deps;
+  const volume = `archme-job-${job.id}`;
+  const labels = { [JOB_LABEL]: job.id, [SLOT_LABEL]: String(slot.index) };
+  const sjob = sandboxJobOf(job);
+  const sandbox = {
+    slot: slot.index,
+    memory_peak_bytes: { clone: null, agent: null },
+    model_requests: 0,
+    upstream_429: 0,
+    last_upstream_status: null,
+    cap_hits: 0,
+    mcp_requests: 0,
+    remints: 0,
+    egress_denied: 0,
+    first_egress_denied: null,
+    clone_ms: null,
+    box_ms: 0
+  };
+  const durations = {};
+  const metrics = { sandbox, durations_ms: durations };
+  const liveBoxes = /* @__PURE__ */ new Set();
+  const inputCleanups = [];
+  let volumeTouched = false;
+  let agentStarted = false;
+  const readCounters = () => {
+    const c3 = deps.gates.countersFor(slot);
+    if (!c3) return;
+    sandbox.model_requests = c3.model_requests;
+    sandbox.upstream_429 = c3.upstream_429;
+    sandbox.last_upstream_status = c3.last_upstream_status;
+    sandbox.cap_hits = c3.cap_hits;
+    sandbox.mcp_requests = c3.mcp_requests;
+    sandbox.remints = c3.remints;
+    sandbox.egress_denied = c3.egress_denied;
+    sandbox.first_egress_denied = c3.first_egress_denied;
+  };
+  const failed = (step, reason, stderr = "") => {
+    deps.log(`sandbox ${step} step failed: ${reason}`);
+    return { kind: "step_failed", step, reason, stderr, metrics };
+  };
+  const currentKillCause = () => {
+    if (deps.isCancelled(job.id)) return "cancel";
+    if (deps.killReason(job.id) === "shutdown") return "shutdown";
+    if (deps.isLeaseLost(job.id)) return "lease_lost";
+    return null;
+  };
+  const writeInput = async (step, input) => {
+    const w = await deps.writeInputDir(step, input);
+    let done = false;
+    const cleanup = async () => {
+      if (done) return;
+      done = true;
+      await w.cleanup().catch(() => {
+      });
     };
+    inputCleanups.push(cleanup);
+    return { dir: w.dir, cleanup };
   };
-}
-function defaultSpawn(bin = "container") {
-  return (args) => {
-    const p = execa(bin, args, { reject: false, stdin: "pipe", buffer: false });
+  const runBox = async (spec2, timeoutMs) => {
+    if (deps.isCancelled(job.id)) return { kind: "refused", reason: "cancel" };
+    if (!await deps.registry.beginStep(job.id, spec2.name)) return { kind: "refused", reason: "shutting_down" };
+    liveBoxes.add(spec2.name);
+    const started = now();
+    let killCause = null;
+    const kill = (cause) => {
+      if (killCause) return;
+      killCause = cause;
+      deps.log(`killing ${spec2.name} (${cause})`);
+      if (cause === "lease_lost") deps.gates.clearJob(slot);
+      void deps.runtime.kill(spec2.name).catch((e) => deps.log(`kill ${spec2.name} failed: ${e.message}`));
+    };
+    if (spec2.args[0] === "agent") agentStarted = true;
+    const handle = await deps.runtime.runStep(spec2);
+    const timer = setTimeout(() => kill("timeout"), timeoutMs);
+    const poll = setInterval(() => {
+      const c3 = currentKillCause();
+      if (c3) kill(c3);
+    }, pollMs);
+    try {
+      const exit = await handle.done;
+      liveBoxes.delete(spec2.name);
+      deps.registry.endStep(job.id, spec2.name);
+      if (!killCause && exit.killed) killCause = currentKillCause() ?? "shutdown";
+      return { kind: "ran", exit, killCause, ms: now() - started };
+    } finally {
+      clearTimeout(timer);
+      clearInterval(poll);
+    }
+  };
+  const spec = (step, env, inputDir) => ({
+    name: `archme-job-${job.id}-${step}`,
+    image: settings.image,
+    args: [step],
+    network: slot,
+    env,
+    inputDir,
+    volume,
+    limits: { cpus: settings.boxCpus, memoryMiB: settings.boxMemoryMiB },
+    labels: { ...labels }
+  });
+  const runBoxes = async (pre) => {
+    deps.registry.setVolume(job.id, volume);
+    volumeTouched = true;
+    await deps.runtime.createVolume(volume, settings.volumeGiB, labels);
+    await deps.runtime.initVolume(volume, BOX_UID, labels, settings.image, slot);
+    deps.gates.bindJob(slot, {
+      jobId: job.id,
+      maxModelRequests: settings.maxModelRequests,
+      mcp: {
+        token: pre.jobToken.token,
+        expiresAt: pre.jobToken.expires_at ? Date.parse(pre.jobToken.expires_at) || null : null,
+        projectSlug: pre.projectSlug,
+        branch: job.archme_branch
+      }
+    });
+    const cloneIn = await writeInput("clone", {
+      kind: "clone",
+      job: sjob,
+      marker: pre.marker,
+      credentials: {
+        https_url: pre.credentials.https_url,
+        username: pre.credentials.username,
+        password: pre.credentials.password
+      }
+    });
+    deps.gates.setStep(slot, "clone");
+    const clone = await runBox(spec("clone", deps.cloneBoxEnv(slot.gateway), cloneIn.dir), t.cloneMs);
+    await cloneIn.cleanup();
+    if (clone.kind === "refused") return failed("clone", clone.reason);
+    sandbox.clone_ms = clone.ms;
+    sandbox.box_ms += clone.ms;
+    durations.sandbox_clone = clone.ms;
+    if (clone.killCause) return failed("clone", clone.killCause, clone.exit.stderr);
+    const cp = deps.parseResultLine(clone.exit.stdout, clone.exit.nonce);
+    if (!cp.ok || cp.result.kind !== "clone") {
+      deps.log(`clone result line: ${cp.ok ? `unexpected kind ${cp.result.kind}` : cp.reason}`);
+      return failed("clone", "result_malformed", clone.exit.stderr);
+    }
+    const cr = cp.result;
+    sandbox.memory_peak_bytes.clone = cr.memoryPeakBytes;
+    for (const [k, v] of Object.entries(cr.durations_ms ?? {})) durations[`clone_${k}`] = v;
+    if (cr.outcome === "skip") return { kind: "skip", metrics };
+    if (cr.outcome === "rejected") return { kind: "rejected", message: cr.error ?? "job rejected by the clone step", metrics };
+    if (cr.error || clone.exit.exitCode !== 0 || !cr.diff) {
+      return failed("clone", cr.error ?? `clone step exited ${clone.exit.exitCode}`, clone.exit.stderr);
+    }
+    Object.assign(metrics, {
+      mode: job.source_mode === "pr_update" ? "pr_update" : "diff",
+      files: cr.diff.files,
+      bytes: cr.diff.bytes,
+      materialized: cr.diff.materialized,
+      range: cr.diff.rangeLabel,
+      model: pre.model
+    });
+    const claudeMs = cr.diff.materialized ? t.largeDiffClaudeMs : t.claudeMs;
+    const agentIn = await writeInput("agent", {
+      kind: "agent",
+      job: sjob,
+      projectSlug: pre.projectSlug,
+      seedArch: pre.seedArch,
+      repoScope: pre.repoScope,
+      repoContainer: pre.repoContainer,
+      bugsFolderId: pre.bugsFolderId,
+      model: pre.model,
+      timeoutMs: claudeMs,
+      gateway: slot.gateway
+    });
+    deps.gates.setStep(slot, "agent");
+    const agent = await runBox(spec("agent", deps.agentBoxEnv(slot.gateway), agentIn.dir), claudeMs + t.graceMs);
+    await agentIn.cleanup();
+    if (agent.kind === "refused") return failed("agent", agent.reason);
+    sandbox.box_ms += agent.ms;
+    durations.sandbox_agent = agent.ms;
+    readCounters();
+    if (agent.killCause) return failed("agent", agent.killCause, agent.exit.stderr);
+    const ap = deps.parseResultLine(agent.exit.stdout, agent.exit.nonce);
+    if (!ap.ok || ap.result.kind !== "agent") {
+      deps.log(`agent result line: ${ap.ok ? `unexpected kind ${ap.result.kind}` : ap.reason}`);
+      return failed("agent", "result_malformed", agent.exit.stderr);
+    }
+    const ar = ap.result;
+    sandbox.memory_peak_bytes.agent = ar.memoryPeakBytes;
+    for (const [k, v] of Object.entries(ar.durations_ms ?? {})) durations[`agent_${k}`] = v;
+    if (ar.seed) metrics.seed = ar.seed;
+    if (ar.error) return failed("agent", ar.error, agent.exit.stderr);
     return {
-      stdin: p.stdin,
-      stdout: p.stdout,
-      stderr: p.stderr,
-      exited: p.then((r) => ({
-        exitCode: r.exitCode ?? null,
-        signal: r.signal ?? null,
-        error: r.exitCode === void 0 && !r.signal ? r.message : void 0
-      }))
+      kind: "claude",
+      exitCode: ar.exitCode,
+      signal: ar.signal,
+      claudeStdout: ar.claudeStdout,
+      stderr: agent.exit.stderr,
+      affected: ar.affected,
+      metrics
     };
   };
+  try {
+    const pre = await deps.prefetch(job);
+    try {
+      return await runBoxes(pre);
+    } catch (e) {
+      if (e instanceof SandboxInfraError) throw e;
+      throw new SandboxInfraError(e instanceof Error ? e.message : String(e), agentStarted);
+    }
+  } finally {
+    const step = async (what, fn) => {
+      try {
+        await fn();
+      } catch (e) {
+        deps.log(`sandbox cleanup (${what}) failed: ${e.message}`);
+      }
+    };
+    for (const name of liveBoxes) await step(`kill ${name}`, () => deps.runtime.kill(name));
+    if (volumeTouched) await step("remove volume", () => deps.runtime.removeVolume(volume));
+    await step("counters", readCounters);
+    await step("clear gates", () => deps.gates.clearJob(slot));
+    await step("free slot", () => deps.pool.free(slot.index));
+    for (const c3 of inputCleanups) await step("input dir", c3);
+    await step("release", () => deps.registry.release(job.id));
+  }
 }
-var MIN_MEMORY_MIB, STDOUT_CAP_BYTES, STDERR_CAP_BYTES, NAT_NETWORK, INIT_MEMORY_MIB, NAME_RE, ENV_KEY_RE, LABEL_KEY_RE, CONTROL_RE, obj, str, TailBuffer, AppleContainerRuntime;
-var init_appleContainer = __esm({
-  "src/daemon/sandbox/appleContainer.ts"() {
+var DEFAULT_SANDBOX_TIMEOUTS, SandboxInfraError;
+var init_runSandboxedJob = __esm({
+  "src/daemon/sandbox/runSandboxedJob.ts"() {
     "use strict";
-    init_execa();
-    init_sweep();
     init_types();
-    MIN_MEMORY_MIB = 200;
-    STDOUT_CAP_BYTES = 4 * 1024 * 1024;
-    STDERR_CAP_BYTES = 1024 * 1024;
-    NAT_NETWORK = "default";
-    INIT_MEMORY_MIB = 256;
-    NAME_RE = /^[a-z0-9][a-z0-9_.-]*$/;
-    ENV_KEY_RE = /^[A-Z_][A-Z0-9_]*$/;
-    LABEL_KEY_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
-    CONTROL_RE = /[\u0000\n\r]/;
-    obj = (v) => v && typeof v === "object" ? v : {};
-    str = (v) => typeof v === "string" ? v : null;
-    TailBuffer = class {
-      constructor(cap) {
-        this.cap = cap;
-      }
-      chunks = [];
-      size = 0;
-      truncated = false;
-      push(chunk) {
-        this.chunks.push(chunk);
-        this.size += chunk.length;
-        while (this.size > this.cap && this.chunks.length > 0) {
-          const head = this.chunks[0];
-          const over = this.size - this.cap;
-          this.truncated = true;
-          if (head.length <= over) {
-            this.chunks.shift();
-            this.size -= head.length;
-          } else {
-            this.chunks[0] = head.subarray(over);
-            this.size -= over;
-          }
-        }
-      }
-      toString() {
-        let buf = Buffer.concat(this.chunks);
-        if (this.truncated) {
-          let i2 = 0;
-          while (i2 < buf.length && i2 < 3 && (buf[i2] & 192) === 128) i2++;
-          buf = buf.subarray(i2);
-        }
-        return buf.toString("utf8");
-      }
-    };
-    AppleContainerRuntime = class {
-      constructor(opts = {}) {
-        this.opts = opts;
-        this.exec = opts.exec ?? defaultExec2(opts.bin);
-        this.spawn = opts.spawn ?? defaultSpawn(opts.bin);
-      }
-      name = "apple-container";
-      exec;
-      spawn;
-      /** Boxes `kill()` was called for while their step was running. */
-      killedNames = /* @__PURE__ */ new Set();
-      running = /* @__PURE__ */ new Set();
-      async must(args, what) {
-        const r = await this.exec(args);
-        if (r.exitCode !== 0) throw new Error(`sandbox: ${what} failed (exit ${r.exitCode}): ${r.stderr.trim()}`);
-        return r;
-      }
-      async preflight() {
-        const checks = [];
-        const status = await this.exec(["system", "status"]);
-        const up = status.exitCode === 0 && /^status\s+running\b/m.test(status.stdout);
-        checks.push({ name: "runtime_status", ok: up, detail: up ? void 0 : (status.stderr || status.stdout).trim() });
-        if (this.opts.image) {
-          let img = await this.exec(["image", "inspect", this.opts.image]);
-          if (img.exitCode !== 0 && up && this.opts.image.includes("@sha256:")) {
-            const pull = await this.exec(["image", "pull", this.opts.image]);
-            img = pull.exitCode === 0 ? await this.exec(["image", "inspect", this.opts.image]) : pull;
-          }
-          checks.push({ name: "image_present", ok: img.exitCode === 0, detail: img.exitCode === 0 ? void 0 : img.stderr.trim() });
-        } else {
-          checks.push({ name: "image_present", ok: false, detail: "no image configured" });
-        }
-        const want = this.opts.slots ?? 0;
-        if (up) {
-          const nets = await this.listNetworks();
-          const missing = [];
-          for (let i2 = 0; i2 < want; i2++) {
-            const s = slotFor(i2);
-            const n2 = nets.find((x) => x.name === s.network);
-            if (!n2 || n2.subnet !== s.subnet) missing.push(n2 ? `${s.network} (subnet ${n2.subnet})` : s.network);
-          }
-          checks.push({ name: "slot_networks", ok: missing.length === 0, detail: missing.length ? `missing/wrong: ${missing.join(", ")}` : void 0 });
-        } else {
-          checks.push({ name: "slot_networks", ok: false, detail: "runtime not running" });
-        }
-        checks.push({ name: "pf_anchor", ok: true, detail: "skipped (19.3)" });
-        checks.push({ name: "ipv6_probe", ok: true, detail: "skipped (19.3)" });
-        return { ok: checks.every((c3) => c3.ok), checks };
-      }
-      async listNetworks() {
-        const r = await this.must(["network", "ls", "--format", "json"], "network ls");
-        return parseNetworkList(r.stdout);
-      }
-      async ensureSlots(n2) {
-        if (!Number.isInteger(n2) || n2 < 1 || n2 > MAX_SLOTS) throw new Error(`sandbox: slot count out of range: ${n2}`);
-        const slots = Array.from({ length: n2 }, (_, i2) => slotFor(i2));
-        let nets = await this.listNetworks();
-        for (const s of slots) {
-          const existing = nets.find((x) => x.name === s.network);
-          if (existing) {
-            if (existing.subnet !== s.subnet) {
-              throw new Error(`sandbox: ${s.network} exists with subnet ${existing.subnet}, expected ${s.subnet}`);
-            }
-            continue;
-          }
-          const r = await this.exec(buildEnsureNetworkArgs(s));
-          if (r.exitCode !== 0) {
-            nets = await this.listNetworks();
-            const now = nets.find((x) => x.name === s.network);
-            if (!now || now.subnet !== s.subnet) {
-              throw new Error(`sandbox: creating ${s.network} failed: ${r.stderr.trim()}`);
-            }
-          }
-        }
-        return slots;
-      }
-      async createVolume(name, sizeGiB, labels) {
-        await this.must(buildCreateVolumeArgs(name, sizeGiB, labels), `volume create ${name}`);
-      }
-      async initVolume(name, uid, labels, image) {
-        await this.must(buildInitVolumeArgs(name, uid, labels, image), `volume init ${name}`);
-      }
-      async runStep(spec) {
-        const args = buildRunArgs(spec, this.opts.homeDir);
-        const name = spec.name;
-        this.running.add(name);
-        this.killedNames.delete(name);
-        const out = new TailBuffer(STDOUT_CAP_BYTES);
-        const err4 = new TailBuffer(STDERR_CAP_BYTES);
-        const nonce = randomBytes2(16).toString("hex");
-        const proc = this.spawn(args);
-        if (proc.stdin) {
-          proc.stdin.on("error", () => {
-          });
-          proc.stdin.end(`${nonce}
-`);
-        }
-        const tee = (stream, buf, which) => new Promise((resolve7) => {
-          if (!stream) return resolve7();
-          stream.on("data", (c3) => {
-            const b = typeof c3 === "string" ? Buffer.from(c3) : c3;
-            buf.push(b);
-            this.opts.onOutput?.(name, which, b);
-          });
-          stream.on("end", () => resolve7());
-          stream.on("close", () => resolve7());
-          stream.on("error", () => resolve7());
-        });
-        const done = (async () => {
-          const [exit] = await Promise.all([proc.exited, tee(proc.stdout, out, "stdout"), tee(proc.stderr, err4, "stderr")]);
-          const killed = this.killedNames.has(name);
-          this.killedNames.delete(name);
-          this.running.delete(name);
-          const stderr = err4.toString();
-          return {
-            exitCode: exit.exitCode,
-            signal: exit.signal,
-            stdout: out.toString(),
-            stderr: exit.error ? `${stderr}
-${exit.error}`.trim() : stderr,
-            killed,
-            nonce
-          };
-        })();
-        return { name, done };
-      }
-      /** Not-found and already-stopped both count as success: the box is not running. */
-      async kill(name) {
-        assertName("box", name);
-        if (this.running.has(name)) this.killedNames.add(name);
-        const r = await this.exec(["kill", name]);
-        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr) && !isBoxStopped(r.stderr)) {
-          throw new Error(`sandbox: kill ${name} failed: ${r.stderr.trim()}`);
-        }
-      }
-      async stop(name, graceSeconds) {
-        assertName("box", name);
-        const t = Math.max(0, Math.floor(graceSeconds));
-        const r = await this.exec(["stop", "-t", String(t), name]);
-        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr) && !isBoxStopped(r.stderr)) {
-          throw new Error(`sandbox: stop ${name} failed: ${r.stderr.trim()}`);
-        }
-      }
-      /** `container rm`; not-found counts as removed (a `--rm` box is gone once stopped). */
-      async remove(name) {
-        assertName("box", name);
-        const r = await this.exec(["rm", name]);
-        if (r.exitCode !== 0 && !isBoxNotFound(r.stderr)) {
-          throw new Error(`sandbox: rm ${name} failed: ${r.stderr.trim()}`);
-        }
-      }
-      async removeVolume(name) {
-        assertName("volume", name);
-        const r = await this.exec(["volume", "rm", name]);
-        if (r.exitCode === 0) return;
-        const still = (await this.listVolumes()).some((v) => v.name === name);
-        if (still) throw new Error(`sandbox: volume rm ${name} failed: ${r.stderr.trim()}`);
-      }
-      async list() {
-        const r = await this.must(["ls", "-a", "--format", "json"], "ls");
-        return parseBoxList(r.stdout);
-      }
-      async listVolumes() {
-        const r = await this.must(["volume", "ls", "--format", "json"], "volume ls");
-        return parseVolumeList(r.stdout);
+    DEFAULT_SANDBOX_TIMEOUTS = {
+      claudeMs: 30 * 60 * 1e3,
+      largeDiffClaudeMs: 45 * 60 * 1e3,
+      graceMs: 2 * 60 * 1e3,
+      cloneMs: 10 * 60 * 1e3
+    };
+    SandboxInfraError = class extends Error {
+      constructor(message2, agentStarted) {
+        super(message2);
+        this.agentStarted = agentStarted;
+        this.name = "SandboxInfraError";
       }
-      sweep() {
-        return sweepJobs(this);
+    };
+  }
+});
+
+// src/daemon/sandbox/classifySandboxExit.ts
+function classifySandboxExit(input) {
+  const { counters, exitCode, stderr, stepFailure } = input;
+  if ((counters?.cap_hits ?? 0) > 0 || stderr.includes(SANDBOX_CAP_BODY)) {
+    return {
+      kind: "terminal",
+      reason: SANDBOX_REQUEST_CAP_REASON,
+      message: `${SANDBOX_REQUEST_CAP_REASON}: the job exceeded the sandbox model-request cap` + (counters ? ` (${counters.model_requests} requests, ${counters.cap_hits} refused)` : "")
+    };
+  }
+  if (stepFailure == null && exitCode !== null && exitCode !== 0 && counters?.last_upstream_status === 429) {
+    return { kind: "upstream_rate_limit" };
+  }
+  return { kind: "normal" };
+}
+function routeSandboxFailure(verdict, planFor, nowMs = Date.now()) {
+  if (verdict?.kind === "terminal") return { kind: "terminal", message: verdict.message };
+  const plan = planFor();
+  if (plan) return { kind: "defer", plan };
+  if (verdict?.kind === "upstream_rate_limit") {
+    return {
+      kind: "defer",
+      plan: { parsed: false, pauseUntil: new Date(nowMs + RATE_LIMIT_TENTATIVE_PAUSE_MS), info: null }
+    };
+  }
+  return { kind: "fail" };
+}
+var SANDBOX_REQUEST_CAP_REASON, SandboxExitError;
+var init_classifySandboxExit = __esm({
+  "src/daemon/sandbox/classifySandboxExit.ts"() {
+    "use strict";
+    init_rateLimit();
+    init_types();
+    SANDBOX_REQUEST_CAP_REASON = "sandbox_request_cap";
+    SandboxExitError = class extends Error {
+      constructor(message2, verdict) {
+        super(message2);
+        this.verdict = verdict;
+        this.name = "SandboxExitError";
       }
     };
   }
@@ -19540,6 +20136,47 @@ function createGateServer(opts) {
       fail2(e);
     }
   });
+  if (opts.connect) {
+    const connect = opts.connect;
+    server.on("connect", (req, socket, head) => {
+      const target = (req.url ?? "").slice(0, 300);
+      const slot = opts.slotMap.resolve(req.socket.localAddress, req.socket.remoteAddress);
+      socket.on("error", () => {
+      });
+      if (!slot) {
+        log(`[${opts.name}] CONNECT ${target} drop job=-`);
+        socket.destroy();
+        return;
+      }
+      const binding = opts.slotMap.binding(slot.index);
+      if (!binding) {
+        log(`[${opts.name}] CONNECT ${target} 403 job=- slot=${slot.index} idle`);
+        socket.end("HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n");
+        return;
+      }
+      let logged = false;
+      const ctx = {
+        slot,
+        binding,
+        path: target,
+        done(status, note) {
+          if (logged) return;
+          logged = true;
+          log(`[${opts.name}] CONNECT ${target} ${status} job=${binding.jobId}${note ? ` ${note}` : ""}`);
+        }
+      };
+      const fail2 = (e) => {
+        ctx.done(502, `handler error: ${e?.name ?? "error"}`);
+        if (socket.writable) socket.end("HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n");
+        else socket.destroy();
+      };
+      try {
+        Promise.resolve(connect(req, socket, head, ctx)).catch(fail2);
+      } catch (e) {
+        fail2(e);
+      }
+    });
+  }
   server.requestTimeout = 0;
   server.headersTimeout = 6e4;
   return {
@@ -19706,12 +20343,121 @@ var init_credentialGate = __esm({
   }
 });
 
+// src/daemon/sandbox/githubGate.ts
+import net from "node:net";
+function parseConnectTarget(authority) {
+  const i2 = authority.lastIndexOf(":");
+  if (i2 <= 0) return { ok: false };
+  const portStr = authority.slice(i2 + 1);
+  let host = authority.slice(0, i2).toLowerCase();
+  if (host.startsWith("[") && host.endsWith("]")) host = host.slice(1, -1);
+  if (host.endsWith(".")) host = host.slice(0, -1);
+  if (portStr !== "443" || net.isIP(host) !== 0 || !GITHUB_ALLOWED_HOSTS.has(host)) return { ok: false };
+  return { ok: true, host, port: 443 };
+}
+var GITHUB_ALLOWED_HOSTS, FORBIDDEN, BAD_GATEWAY, GithubGate;
+var init_githubGate = __esm({
+  "src/daemon/sandbox/githubGate.ts"() {
+    "use strict";
+    init_gateServer();
+    init_types();
+    GITHUB_ALLOWED_HOSTS = /* @__PURE__ */ new Set(["github.com", "codeload.github.com"]);
+    FORBIDDEN = "HTTP/1.1 403 Forbidden\r\nContent-Length: 0\r\n\r\n";
+    BAD_GATEWAY = "HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\n\r\n";
+    GithubGate = class {
+      gate;
+      dial;
+      /** Open tunnels per slot: a clone-step tunnel must not outlive the clone step. */
+      tunnels = /* @__PURE__ */ new Map();
+      constructor(opts) {
+        this.dial = opts.dial ?? ((host, port) => net.connect({ host, port }));
+        this.gate = createGateServer({
+          name: "github-gate",
+          slotMap: opts.slotMap,
+          host: opts.host,
+          port: opts.port ?? GATE_PORTS.github,
+          logger: opts.logger,
+          handler: (_req, res, ctx) => {
+            ctx.done(404);
+            res.writeHead(404).end();
+          },
+          connect: (req, socket, head, ctx) => this.tunnel(req, socket, head, ctx)
+        });
+      }
+      listen() {
+        return this.gate.listen();
+      }
+      async close() {
+        for (const index of [...this.tunnels.keys()]) this.closeTunnels(index);
+        await this.gate.close();
+      }
+      /** The slot's step moved (clone → agent): its tunnels go. */
+      onStepChange(index) {
+        this.closeTunnels(index);
+      }
+      onClear(index) {
+        this.closeTunnels(index);
+      }
+      closeTunnels(index) {
+        const set = this.tunnels.get(index);
+        if (!set) return;
+        this.tunnels.delete(index);
+        for (const destroy of set) destroy();
+      }
+      tunnel(_req, socket, head, ctx) {
+        const { counters } = ctx.binding;
+        const refuse = (note) => {
+          counters.egress_denied++;
+          counters.first_egress_denied ??= ctx.path;
+          ctx.done(403, note);
+          socket.end(FORBIDDEN);
+        };
+        if (ctx.binding.step !== "clone") return refuse(`step=${ctx.binding.step ?? "none"}`);
+        const target = parseConnectTarget(ctx.path);
+        if (!target.ok) return refuse("not allowed");
+        const upstream = this.dial(target.host, target.port);
+        let set = this.tunnels.get(ctx.slot.index);
+        if (!set) this.tunnels.set(ctx.slot.index, set = /* @__PURE__ */ new Set());
+        const destroy = () => {
+          upstream.destroy();
+          socket.destroy();
+        };
+        set.add(destroy);
+        let open4 = false;
+        const cleanup = () => {
+          set.delete(destroy);
+          destroy();
+        };
+        upstream.once("connect", () => {
+          open4 = true;
+          ctx.done(200);
+          socket.write("HTTP/1.1 200 Connection Established\r\n\r\n");
+          if (head.length) upstream.write(head);
+          upstream.pipe(socket);
+          socket.pipe(upstream);
+        });
+        upstream.on("error", () => {
+          if (open4) return;
+          ctx.done(502, "dial failed");
+          set.delete(destroy);
+          socket.end(BAD_GATEWAY);
+        });
+        upstream.on("close", () => {
+          if (open4) cleanup();
+        });
+        socket.on("close", cleanup);
+        socket.on("error", cleanup);
+      }
+    };
+  }
+});
+
 // src/daemon/sandbox/mcpGate.ts
 function redact(err4) {
   const msg = err4 instanceof Error ? err4.message : "error";
   return msg.replace(/\b(amj_|am_|sk-ant-|eyJ)[A-Za-z0-9._-]*/g, "[redacted]").slice(0, 200);
 }
-var MCP_PATH, REMINT_LEAD_MS, MAX_TIMER_MS, realTimers, McpGate;
+var MCP_PATH, REMINT_LEAD_MS, MAX_TIMER_MS, realTimers2, McpGate;
 var init_mcpGate = __esm({
   "src/daemon/sandbox/mcpGate.ts"() {
     "use strict";
@@ -19720,7 +20466,7 @@ var init_mcpGate = __esm({
     MCP_PATH = "/functions/v1/mcp";
     REMINT_LEAD_MS = 10 * 60 * 1e3;
     MAX_TIMER_MS = 2 ** 31 - 1;
-    realTimers = {
+    realTimers2 = {
       now: () => Date.now(),
       setTimeout: (fn, ms) => {
         const t = setTimeout(fn, ms);
@@ -19733,7 +20479,7 @@ var init_mcpGate = __esm({
       constructor(opts) {
         this.opts = opts;
         this.upstream = new URL(opts.upstream);
-        this.timers = opts.timers ?? realTimers;
+        this.timers = opts.timers ?? realTimers2;
         this.log = opts.logger ?? ((line) => console.log(line));
         this.gate = createGateServer({
           name: "mcp-gate",
@@ -19776,176 +20522,79 @@ var init_mcpGate = __esm({
         const s = this.schedules.get(index);
         if (s) {
           this.timers.clearTimeout(s.handle);
-          this.schedules.delete(index);
-        }
-        this.generation++;
-      }
-      schedule(index, jobId, expiresAt) {
-        const generation = ++this.generation;
-        const arm = (fireAt) => {
-          const delay = Math.max(0, fireAt - this.timers.now());
-          const handle = this.timers.setTimeout(() => {
-            if (this.schedules.get(index)?.generation !== generation) return;
-            if (fireAt - this.timers.now() > 0) arm(fireAt);
-            else void this.remint(index, jobId, generation);
-          }, Math.min(delay, MAX_TIMER_MS));
-          this.schedules.set(index, { jobId, handle, generation });
-        };
-        arm(expiresAt - REMINT_LEAD_MS);
-      }
-      async remint(index, jobId, generation) {
-        let next;
-        try {
-          next = await this.opts.remint(jobId);
-        } catch (err4) {
-          if (this.schedules.get(index)?.generation === generation) this.schedules.delete(index);
-          this.log(`[mcp-gate] remint failed job=${jobId}: ${redact(err4)}`);
-          return;
-        }
-        const binding = this.opts.slotMap.binding(index);
-        if (this.schedules.get(index)?.generation !== generation || binding?.jobId !== jobId || !binding.mcp) {
-          this.log(`[mcp-gate] remint discarded job=${jobId}: slot moved on`);
-          return;
-        }
-        binding.mcp = { ...binding.mcp, token: next.token, expiresAt: next.expiresAt };
-        binding.counters.remints++;
-        this.schedules.delete(index);
-        this.log(`[mcp-gate] remint ok job=${jobId}`);
-        if (next.expiresAt === null) return;
-        if (next.expiresAt - REMINT_LEAD_MS <= this.timers.now()) {
-          this.log(`[mcp-gate] reminted token expires inside the lead window job=${jobId}; not rescheduling`);
-          return;
-        }
-        this.schedule(index, jobId, next.expiresAt);
-      }
-      handle(req, res, ctx) {
-        if (ctx.path !== MCP_PATH) {
-          ctx.done(404);
-          res.writeHead(404).end();
-          return;
-        }
-        if (req.method === "GET") {
-          ctx.done(405);
-          res.writeHead(405, { allow: "POST" }).end();
-          return;
-        }
-        if (req.method !== "POST") {
-          ctx.done(404);
-          res.writeHead(404).end();
-          return;
-        }
-        const mcp = ctx.binding.mcp;
-        if (!mcp) {
-          ctx.done(403, "no-mcp");
-          res.writeHead(403).end();
-          return;
-        }
-        ctx.binding.counters.mcp_requests++;
-        const headers = filterHeaders(
-          req.headers,
-          (k) => k === "authorization" || k === "apikey" || k.startsWith("x-archme-source-")
-        );
-        headers.authorization = `Bearer ${mcp.token}`;
-        const target = new URL(this.upstream.href);
-        target.search = new URLSearchParams({ project: mcp.projectSlug, branch: mcp.branch }).toString();
-        void forward(req, res, target, headers).then((r) => ctx.done(r.status));
-      }
-    };
-  }
-});
-
-// src/daemon/sandbox/slotMap.ts
-function parseIpv4(addr) {
-  const m = IPV4_RE.exec(addr);
-  if (!m) return null;
-  let v = 0;
-  for (let i2 = 1; i2 <= 4; i2++) {
-    const o2 = Number(m[i2]);
-    if (o2 > 255) return null;
-    v = v * 256 + o2;
-  }
-  return v >>> 0;
-}
-function parseCidr(cidr) {
-  const [ip, bits, extra] = cidr.split("/");
-  if (ip === void 0 || bits === void 0 || extra !== void 0 || !/^\d{1,2}$/.test(bits)) return null;
-  const n2 = Number(bits);
-  const base = parseIpv4(ip);
-  if (base === null || n2 > 32) return null;
-  const mask = n2 === 0 ? 0 : ~0 << 32 - n2 >>> 0;
-  return { base: (base & mask) >>> 0, mask };
-}
-function stripMapped(addr) {
-  return (addr ?? "").replace(/^::ffff:/i, "");
-}
-var IPV4_RE, SlotMap;
-var init_slotMap = __esm({
-  "src/daemon/sandbox/slotMap.ts"() {
-    "use strict";
-    init_appleContainer();
-    IPV4_RE = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    SlotMap = class {
-      byIndex = /* @__PURE__ */ new Map();
-      byGateway = /* @__PURE__ */ new Map();
-      allowGatewayAsPeer;
-      constructor(slots, opts = {}) {
-        this.allowGatewayAsPeer = opts.allowGatewayAsPeer ?? false;
-        for (const slot of slots) {
-          const gateway = parseIpv4(slot.gateway);
-          const cidr = parseCidr(slot.subnet);
-          if (gateway === null) throw new Error(`slot ${slot.index}: gateway is not an IPv4 address`);
-          if (cidr === null) throw new Error(`slot ${slot.index}: subnet is not an IPv4 CIDR`);
-          if (this.byIndex.has(slot.index)) throw new Error(`slot ${slot.index}: duplicate index`);
-          if (this.byGateway.has(slot.gateway)) throw new Error(`slot ${slot.index}: duplicate gateway`);
-          const entry = { slot, gateway, cidr, binding: null };
-          this.byIndex.set(slot.index, entry);
-          this.byGateway.set(slot.gateway, entry);
-        }
-      }
-      /**
-       * The slot a connection belongs to, or null (drop it). `local` must be a slot
-       * gateway; `remote` must be a plain IPv4 inside THAT slot's subnet — never
-       * IPv6, never another slot's range.
-       */
-      resolve(localAddress, remoteAddress) {
-        const entry = this.byGateway.get(stripMapped(localAddress));
-        if (!entry) return null;
-        const remoteStr = stripMapped(remoteAddress);
-        const remote = parseIpv4(remoteStr);
-        if (remote === null) return null;
-        if ((remote & entry.cidr.mask) >>> 0 !== entry.cidr.base) return null;
-        if (remote === entry.gateway && !this.allowGatewayAsPeer) return null;
-        return entry.slot;
-      }
-      slots() {
-        return [...this.byIndex.values()].map((e) => e.slot);
-      }
-      slot(index) {
-        return this.byIndex.get(index)?.slot ?? null;
-      }
-      bind(index, binding) {
-        const entry = this.entry(index);
-        if (entry.binding && entry.binding.jobId !== binding.jobId) {
-          throw new Error(`slot ${index} is bound to another job`);
-        }
-        entry.binding = binding;
-      }
-      clear(index) {
-        this.entry(index).binding = null;
+          this.schedules.delete(index);
+        }
+        this.generation++;
       }
-      binding(index) {
-        return this.byIndex.get(index)?.binding ?? null;
+      schedule(index, jobId, expiresAt) {
+        const generation = ++this.generation;
+        const arm = (fireAt) => {
+          const delay = Math.max(0, fireAt - this.timers.now());
+          const handle = this.timers.setTimeout(() => {
+            if (this.schedules.get(index)?.generation !== generation) return;
+            if (fireAt - this.timers.now() > 0) arm(fireAt);
+            else void this.remint(index, jobId, generation);
+          }, Math.min(delay, MAX_TIMER_MS));
+          this.schedules.set(index, { jobId, handle, generation });
+        };
+        arm(expiresAt - REMINT_LEAD_MS);
       }
-      bindingForJob(jobId) {
-        for (const e of this.byIndex.values()) {
-          if (e.binding?.jobId === jobId) return { slot: e.slot, binding: e.binding };
+      async remint(index, jobId, generation) {
+        let next;
+        try {
+          next = await this.opts.remint(jobId);
+        } catch (err4) {
+          if (this.schedules.get(index)?.generation === generation) this.schedules.delete(index);
+          this.log(`[mcp-gate] remint failed job=${jobId}: ${redact(err4)}`);
+          return;
         }
-        return null;
+        const binding = this.opts.slotMap.binding(index);
+        if (this.schedules.get(index)?.generation !== generation || binding?.jobId !== jobId || !binding.mcp) {
+          this.log(`[mcp-gate] remint discarded job=${jobId}: slot moved on`);
+          return;
+        }
+        binding.mcp = { ...binding.mcp, token: next.token, expiresAt: next.expiresAt };
+        binding.counters.remints++;
+        this.schedules.delete(index);
+        this.log(`[mcp-gate] remint ok job=${jobId}`);
+        if (next.expiresAt === null) return;
+        if (next.expiresAt - REMINT_LEAD_MS <= this.timers.now()) {
+          this.log(`[mcp-gate] reminted token expires inside the lead window job=${jobId}; not rescheduling`);
+          return;
+        }
+        this.schedule(index, jobId, next.expiresAt);
       }
-      entry(index) {
-        const e = this.byIndex.get(index);
-        if (!e) throw new Error(`unknown slot ${index}`);
-        return e;
+      handle(req, res, ctx) {
+        if (ctx.path !== MCP_PATH) {
+          ctx.done(404);
+          res.writeHead(404).end();
+          return;
+        }
+        if (req.method === "GET") {
+          ctx.done(405);
+          res.writeHead(405, { allow: "POST" }).end();
+          return;
+        }
+        if (req.method !== "POST") {
+          ctx.done(404);
+          res.writeHead(404).end();
+          return;
+        }
+        const mcp = ctx.binding.mcp;
+        if (!mcp) {
+          ctx.done(403, "no-mcp");
+          res.writeHead(403).end();
+          return;
+        }
+        ctx.binding.counters.mcp_requests++;
+        const headers = filterHeaders(
+          req.headers,
+          (k) => k === "authorization" || k === "apikey" || k.startsWith("x-archme-source-")
+        );
+        headers.authorization = `Bearer ${mcp.token}`;
+        const target = new URL(this.upstream.href);
+        target.search = new URLSearchParams({ project: mcp.projectSlug, branch: mcp.branch }).toString();
+        void forward(req, res, target, headers).then((r) => ctx.done(r.status));
       }
     };
   }
@@ -19953,7 +20602,16 @@ var init_slotMap = __esm({
 
 // src/daemon/sandbox/slots.ts
 function zeroCounters() {
-  return { model_requests: 0, upstream_429: 0, last_upstream_status: null, cap_hits: 0, mcp_requests: 0, remints: 0 };
+  return {
+    model_requests: 0,
+    upstream_429: 0,
+    last_upstream_status: null,
+    cap_hits: 0,
+    mcp_requests: 0,
+    remints: 0,
+    egress_denied: 0,
+    first_egress_denied: null
+  };
 }
 function indexOf(slot) {
   return typeof slot === "number" ? slot : slot.index;
@@ -19963,6 +20621,7 @@ var init_slots = __esm({
   "src/daemon/sandbox/slots.ts"() {
     "use strict";
     init_credentialGate();
+    init_githubGate();
     init_mcpGate();
     init_slotMap();
     init_types();
@@ -19970,6 +20629,7 @@ var init_slots = __esm({
       slotMap;
       credential;
       mcp;
+      github;
       boundPorts = null;
       constructor(opts) {
         this.slotMap = new SlotMap(opts.slots, opts.slotMapOptions);
@@ -19990,21 +20650,32 @@ var init_slots = __esm({
           logger: opts.logger,
           timers: opts.timers
         });
+        this.github = new GithubGate({
+          slotMap: this.slotMap,
+          host: opts.host,
+          port: opts.ports?.github ?? GATE_PORTS.github,
+          logger: opts.logger,
+          dial: opts.githubDial
+        });
       }
-      /** Binds both gates; resolves with the ports actually bound. */
+      /** Binds all three gates; resolves with the ports actually bound. */
       async start() {
-        const anthropic = await this.credential.listen();
+        const started = [];
         try {
+          const anthropic = await this.credential.listen();
+          started.push(this.credential);
           const mcp = await this.mcp.listen();
-          this.boundPorts = { anthropic, mcp };
+          started.push(this.mcp);
+          const github = await this.github.listen();
+          this.boundPorts = { anthropic, mcp, github };
           return this.boundPorts;
         } catch (err4) {
-          await this.credential.close();
+          await Promise.all(started.map((g) => g.close()));
           throw err4;
         }
       }
       async stop() {
-        await Promise.all([this.credential.close(), this.mcp.close()]);
+        await Promise.all([this.credential.close(), this.mcp.close(), this.github.close()]);
         this.boundPorts = null;
       }
       ports() {
@@ -20013,177 +20684,70 @@ var init_slots = __esm({
       /** Throws if the slot is unknown or already serving another job. */
       bindJob(slot, input) {
         const index = indexOf(slot);
-        this.slotMap.bind(index, {
-          jobId: input.jobId,
-          maxModelRequests: input.maxModelRequests,
-          mcp: input.mcp ? { ...input.mcp } : null,
-          counters: zeroCounters()
-        });
-        this.mcp.onBind(index);
-      }
-      /** Unbinds the slot (it answers 403 again) and returns the job's final counters. */
-      clearJob(slot) {
-        const index = indexOf(slot);
-        const counters = this.countersFor(index);
-        this.mcp.onClear(index);
-        this.slotMap.clear(index);
-        return counters;
-      }
-      /** A snapshot of the slot's counters, or null when idle. */
-      countersFor(slot) {
-        const b = this.slotMap.binding(indexOf(slot));
-        return b ? { ...b.counters } : null;
-      }
-    };
-    SlotPool = class {
-      free_ = /* @__PURE__ */ new Set();
-      byIndex = /* @__PURE__ */ new Map();
-      constructor(slots) {
-        for (const s of slots) {
-          this.byIndex.set(s.index, s);
-          this.free_.add(s.index);
-        }
-      }
-      /** The lowest free slot, or null when every slot is busy. */
-      lease() {
-        let best = null;
-        for (const i2 of this.free_) if (best === null || i2 < best) best = i2;
-        if (best === null) return null;
-        this.free_.delete(best);
-        return this.byIndex.get(best) ?? null;
-      }
-      /** Idempotent; unknown indices are ignored. */
-      free(index) {
-        if (this.byIndex.has(index)) this.free_.add(index);
-      }
-      available() {
-        return this.free_.size;
-      }
-    };
-  }
-});
-
-// src/daemon/sandboxJob/result.ts
-import { readFile as readFile13 } from "node:fs/promises";
-function isValidNonce(nonce) {
-  return typeof nonce === "string" && RESULT_NONCE_RE.test(nonce);
-}
-function encode(result, nonce) {
-  return `${RESULT_PREFIX}${nonce} ${Buffer.from(JSON.stringify(result), "utf8").toString("base64")}`;
-}
-function fits(line, cap) {
-  return Buffer.byteLength(line, "utf8") <= cap;
-}
-function withTruncatedError(r) {
-  return { ...r, error: r.error ? `${r.error}; ${RESULT_TRUNCATED}` : RESULT_TRUNCATED };
-}
-function minimal(r) {
-  if (r.kind === "clone") {
-    const m2 = { kind: "clone", outcome: r.outcome, memoryPeakBytes: r.memoryPeakBytes, durations_ms: {}, error: RESULT_TRUNCATED };
-    return m2;
-  }
-  const m = {
-    kind: "agent",
-    exitCode: r.exitCode,
-    signal: r.signal,
-    claudeStdout: "",
-    affected: null,
-    promptBytes: r.promptBytes,
-    memoryPeakBytes: r.memoryPeakBytes,
-    durations_ms: {},
-    error: RESULT_TRUNCATED
-  };
-  return m;
-}
-function formatResultLine(result, nonce, cap = RESULT_MAX_BYTES) {
-  if (!isValidNonce(nonce)) throw new Error("result: invalid nonce");
-  const encode_ = (r) => encode(r, nonce);
-  let line = encode_(result);
-  if (fits(line, cap)) return line;
-  if (result.kind === "agent") {
-    const noAffected = { ...result, affected: null };
-    line = encode_(withTruncatedError(noAffected));
-    if (fits(line, cap)) return line;
-    line = encode_(withTruncatedError({ ...noAffected, claudeStdout: "" }));
-    if (fits(line, cap)) return line;
-  }
-  return encode_(minimal(result));
-}
-function isObj(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isNumOrNull(v) {
-  return v === null || typeof v === "number" && Number.isFinite(v);
-}
-function shapeError(o2) {
-  if (!isNumOrNull(o2.memoryPeakBytes)) return "memoryPeakBytes";
-  if (!isObj(o2.durations_ms) || !Object.values(o2.durations_ms).every((v) => typeof v === "number")) return "durations_ms";
-  if (o2.error !== void 0 && typeof o2.error !== "string") return "error";
-  if (o2.kind === "clone") {
-    if (o2.outcome !== "diff" && o2.outcome !== "skip" && o2.outcome !== "rejected") return "outcome";
-    if (o2.diff !== void 0 && !isObj(o2.diff)) return "diff";
-    return null;
-  }
-  if (o2.kind === "agent") {
-    if (!isNumOrNull(o2.exitCode)) return "exitCode";
-    if (o2.signal !== null && typeof o2.signal !== "string") return "signal";
-    if (typeof o2.claudeStdout !== "string") return "claudeStdout";
-    if (o2.affected !== null && !(isObj(o2.affected) && ["stories", "components", "unresolvedFiles"].every((k) => Array.isArray(o2.affected[k])))) {
-      return "affected";
-    }
-    if (typeof o2.promptBytes !== "number") return "promptBytes";
-    return null;
-  }
-  return "kind";
-}
-function parseResultLine(stdout, nonce, cap = RESULT_MAX_BYTES) {
-  if (!isValidNonce(nonce)) return { ok: false, reason: "no result line" };
-  const prefix = `${RESULT_PREFIX}${nonce} `;
-  const lines = stdout.split("\n");
-  let line;
-  for (let i2 = lines.length - 1; i2 >= 0; i2--) {
-    const l = lines[i2].replace(/\r$/, "");
-    if (l.startsWith(prefix)) {
-      line = l;
-      break;
-    }
-  }
-  if (line === void 0) return { ok: false, reason: "no result line" };
-  if (Buffer.byteLength(line, "utf8") > cap) return { ok: false, reason: "result line exceeds cap" };
-  const b64 = line.slice(prefix.length).trim();
-  if (b64 === "" || b64.length % 4 !== 0 || !BASE64_RE.test(b64)) return { ok: false, reason: "result is not base64" };
-  let data;
-  try {
-    data = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
-  } catch {
-    return { ok: false, reason: "result is not JSON" };
-  }
-  if (!isObj(data)) return { ok: false, reason: "result is not an object" };
-  const bad = shapeError(data);
-  if (bad) return { ok: false, reason: `result has a malformed ${bad}` };
-  return { ok: true, result: data };
-}
-async function readMemoryPeak(path7 = "/sys/fs/cgroup/memory.peak", read = (p) => readFile13(p, "utf8")) {
-  try {
-    const n2 = Number.parseInt((await read(path7)).trim(), 10);
-    return Number.isFinite(n2) && n2 >= 0 ? n2 : null;
-  } catch {
-    return null;
-  }
-}
-var RESULT_TRUNCATED, BASE64_RE;
-var init_result2 = __esm({
-  "src/daemon/sandboxJob/result.ts"() {
-    "use strict";
-    init_types();
-    RESULT_TRUNCATED = "result truncated";
-    BASE64_RE = /^[A-Za-z0-9+/]*={0,2}$/;
+        this.slotMap.bind(index, {
+          jobId: input.jobId,
+          maxModelRequests: input.maxModelRequests,
+          mcp: input.mcp ? { ...input.mcp } : null,
+          step: null,
+          counters: zeroCounters()
+        });
+        this.mcp.onBind(index);
+      }
+      /** Which step's box is running on the slot; set before each box starts.
+       *  Leaving the clone step closes the slot's GitHub tunnels. */
+      setStep(slot, step) {
+        const index = indexOf(slot);
+        const b = this.slotMap.binding(index);
+        if (!b) throw new Error(`slot ${index} is not bound`);
+        b.step = step;
+        this.github.onStepChange(index);
+      }
+      /** Unbinds the slot (it answers 403 again) and returns the job's final counters. */
+      clearJob(slot) {
+        const index = indexOf(slot);
+        const counters = this.countersFor(index);
+        this.mcp.onClear(index);
+        this.github.onClear(index);
+        this.slotMap.clear(index);
+        return counters;
+      }
+      /** A snapshot of the slot's counters, or null when idle. */
+      countersFor(slot) {
+        const b = this.slotMap.binding(indexOf(slot));
+        return b ? { ...b.counters } : null;
+      }
+    };
+    SlotPool = class {
+      free_ = /* @__PURE__ */ new Set();
+      byIndex = /* @__PURE__ */ new Map();
+      constructor(slots) {
+        for (const s of slots) {
+          this.byIndex.set(s.index, s);
+          this.free_.add(s.index);
+        }
+      }
+      /** The lowest free slot, or null when every slot is busy. */
+      lease() {
+        let best = null;
+        for (const i2 of this.free_) if (best === null || i2 < best) best = i2;
+        if (best === null) return null;
+        this.free_.delete(best);
+        return this.byIndex.get(best) ?? null;
+      }
+      /** Idempotent; unknown indices are ignored. */
+      free(index) {
+        if (this.byIndex.has(index)) this.free_.add(index);
+      }
+      available() {
+        return this.free_.size;
+      }
+    };
   }
 });
 
 // src/daemon/sandboxJob/clone.ts
-import { mkdir as mkdir11, writeFile as writeFile11 } from "node:fs/promises";
-import { dirname as dirname15 } from "node:path";
+import { mkdir as mkdir12, writeFile as writeFile11 } from "node:fs/promises";
+import { dirname as dirname16 } from "node:path";
 function asArchmeJob(job) {
   return job;
 }
@@ -20208,7 +20772,7 @@ async function runCloneStep(input, deps = {}) {
   const { env: gitEnv, cleanup } = await buildGitEnv(input.credentials);
   const restoreEnv = applyEnv(gitEnv);
   try {
-    await mkdir11(repoDir, { recursive: true });
+    await mkdir12(repoDir, { recursive: true });
     const must = async (args, cwd) => {
       const r = await git4(args, { cwd, env: gitEnv });
       if (r.exitCode !== 0) throw new Error(`git ${args[0]} failed: ${r.stderr.trim()}`);
@@ -20260,7 +20824,7 @@ async function runCloneStep(input, deps = {}) {
       after: diff.after,
       ...diff.provenance ? { provenance: diff.provenance } : {}
     };
-    await mkdir11(dirname15(diffPath), { recursive: true });
+    await mkdir12(dirname16(diffPath), { recursive: true });
     await writeFile11(diffPath, JSON.stringify(persisted), { mode: 384 });
     const bytes = Buffer.byteLength(diff.patch, "utf8");
     log(`diff ${diff.rangeLabel}: ${diff.changedFiles.length} file(s), ${bytes} bytes${diff.materialized ? " (materialized)" : ""}`);
@@ -20316,7 +20880,7 @@ var init_clone = __esm({
 });
 
 // src/daemon/sandboxJob/agent.ts
-import { mkdir as mkdir12, readFile as readFile14, writeFile as writeFile12 } from "node:fs/promises";
+import { mkdir as mkdir13, readFile as readFile14, writeFile as writeFile12 } from "node:fs/promises";
 import { join as join23 } from "node:path";
 function agentBoxEnv(gateway) {
   return {
@@ -20329,10 +20893,16 @@ function agentBoxEnv(gateway) {
     DISABLE_ERROR_REPORTING: "1"
   };
 }
-function cloneBoxEnv() {
+function cloneBoxEnv(gateway) {
+  const proxy = `http://${gateway}:${GATE_PORTS.github}`;
   return {
     HOME: BOX_HOME,
-    GIT_TERMINAL_PROMPT: "0"
+    GIT_TERMINAL_PROMPT: "0",
+    https_proxy: proxy,
+    HTTPS_PROXY: proxy,
+    GIT_CONFIG_COUNT: "1",
+    GIT_CONFIG_KEY_0: "http.proxy",
+    GIT_CONFIG_VALUE_0: proxy
   };
 }
 function boxMcpConfig(gateway) {
@@ -20343,7 +20913,7 @@ function boxMcpConfig(gateway) {
   };
 }
 async function writeBoxMcpConfig(gateway, dir = BOX_MCP_DIR) {
-  await mkdir12(dir, { recursive: true, mode: 448 });
+  await mkdir13(dir, { recursive: true, mode: 448 });
   const path7 = join23(dir, "mcp.json");
   await writeFile12(path7, JSON.stringify(boxMcpConfig(gateway), null, 2), { mode: 384 });
   return path7;
@@ -20411,7 +20981,7 @@ async function runAgentStep(input, deps = {}) {
   );
   const promptBytes = Buffer.byteLength(prompt, "utf8");
   const mcpConfigPath = await writeBoxMcpConfig(input.gateway, deps.mcpDir);
-  for (const d of deps.homeDirs ?? [BOX_HOME, BOX_CLAUDE_CONFIG_DIR]) await mkdir12(d, { recursive: true, mode: 448 });
+  for (const d of deps.homeDirs ?? [BOX_HOME, BOX_CLAUDE_CONFIG_DIR]) await mkdir13(d, { recursive: true, mode: 448 });
   log(`spawning claude (model ${input.model}, prompt ${promptBytes} bytes)`);
   const proc = spawn2({
     prompt,
@@ -20515,6 +21085,7 @@ function createSandboxParts(settings) {
       await gates.start();
       return {
         bindJob: (slot, b) => gates.bindJob(slot, b),
+        setStep: (slot, step) => gates.setStep(slot, step),
         clearJob: (slot) => {
           gates.clearJob(slot);
         },
@@ -20565,7 +21136,7 @@ __export(run_exports, {
 });
 import { createClient } from "@supabase/supabase-js";
 import { randomUUID as randomUUID2 } from "node:crypto";
-import { mkdtemp as mkdtemp4, mkdir as mkdir13, writeFile as writeFile13, rm as rm8, stat as stat8, chmod as chmod5 } from "node:fs/promises";
+import { mkdtemp as mkdtemp4, mkdir as mkdir14, writeFile as writeFile13, rm as rm8, stat as stat8, chmod as chmod6 } from "node:fs/promises";
 import { tmpdir as tmpdir4 } from "node:os";
 import { join as join24 } from "node:path";
 import { homedir as homedir8 } from "node:os";
@@ -20732,7 +21303,7 @@ async function buildGitEnv(credentials) {
     ].join("\n"),
     { mode: 448 }
   );
-  await chmod5(askpassPath, 448).catch(() => {
+  await chmod6(askpassPath, 448).catch(() => {
   });
   const gitConfigEntries = [
     ["credential.helper", ""],
@@ -20793,12 +21364,12 @@ async function ensureCloneAndFetch(ctx, job, claimDeviceId) {
   const deviceId = claimDeviceId ?? ctx.deviceForOrg(job.org_id) ?? ctx.auth.getDeviceId();
   if (!deviceId) throw new Error("daemon is not signed in with a registered device");
   const credentials = await getRepoCredentials(ctx, job.id, deviceId);
-  await mkdir13(ctx.cloneBaseDir, { recursive: true });
+  await mkdir14(ctx.cloneBaseDir, { recursive: true });
   const dir = cloneDirFor(ctx.cloneBaseDir, job.repo_owner, job.repo_name);
   const { env, cleanup: cleanupGitEnv } = await buildGitEnv(credentials);
   await cloneMutex.runExclusive(dir, async () => {
     if (!await exists(join24(dir, ".git"))) {
-      await mkdir13(join24(ctx.cloneBaseDir, job.repo_owner), { recursive: true });
+      await mkdir14(join24(ctx.cloneBaseDir, job.repo_owner), { recursive: true });
       console.log(`  cloning ${job.repo_owner}/${job.repo_name} \u2192 ${dir}`);
       await execa("git", ["clone", "--no-tags", credentials.https_url, dir], { env, reject: true });
     } else {
@@ -21441,7 +22012,7 @@ function sandboxDepsFor(ctx, job, deviceId, host) {
     settings: host.settings,
     parseResultLine: (stdout, nonce) => host.io.parseResultLine(stdout, nonce),
     agentBoxEnv: (gateway) => host.io.agentBoxEnv(gateway),
-    cloneBoxEnv: () => host.io.cloneBoxEnv(),
+    cloneBoxEnv: (gateway) => host.io.cloneBoxEnv(gateway),
     prefetch: (j) => (prefetchOverride ?? prefetchJobContext)(ctx, j, deviceId),
     writeInputDir: (step, input) => writeInputDir(step, input),
     log: (msg) => console.log(`[${job.id}] ${msg}`),
@@ -21585,8 +22156,13 @@ async function runJob(ctx, job, claimDeviceId) {
       const isLocalRepo = findLocalRepoForJob(await loadLocalRepos(), job) != null;
       const decision = shouldSandbox(sandboxHost.settings, job, { isLocalRepo });
       if (decision.reason === "local_repo") log("sandbox_skipped_local_repo: local-poll repo, running unsandboxed");
+      const required = sandboxHost.settings.mode === "required";
+      if (decision.reason === "local_repo" && required) log("sandbox: required mode keeps local-poll repos unboxed (\xA713)");
       const slot = decision.boxed ? sandboxHost.pool.lease() : null;
-      if (decision.boxed && !slot) log("sandbox_no_slot: no free slot, running unsandboxed");
+      if (decision.boxed && !slot) {
+        if (required) throw new Error("sandbox_no_slot: no free sandbox slot (ARCHME_SANDBOX=required); retrying later");
+        log("sandbox_no_slot: no free slot, running unsandboxed");
+      }
       if (slot) sandboxRun: {
         boxedJobs.add(job.id);
         log(`sandbox: running boxed on slot ${slot.index}`);
@@ -21597,7 +22173,7 @@ async function runJob(ctx, job, claimDeviceId) {
             timeouts: { claudeMs: CLAUDE_TIMEOUT_MS, largeDiffClaudeMs: CLAUDE_LARGE_DIFF_TIMEOUT_MS }
           });
         } catch (err4) {
-          if (err4 instanceof SandboxInfraError && !err4.agentStarted && !shuttingDown && !cancelled.has(job.id)) {
+          if (err4 instanceof SandboxInfraError && !err4.agentStarted && !shuttingDown && !cancelled.has(job.id) && sandboxHost.settings.mode === "shadow") {
             log(`sandbox_infra_fallback: ${err4.message}, running unboxed`);
             boxedJobs.delete(job.id);
             break sandboxRun;
@@ -22057,6 +22633,7 @@ async function dispatch(sched) {
     }
     pauseUntilMs = null;
   }
+  if (confinementGate && !confinementGate.allowsClaims()) return;
   sched.dispatching = true;
   try {
     let atCap = false;
@@ -22250,7 +22827,10 @@ async function runDaemon() {
   if (process.env.ARCHME_SANDBOX_SLOTS !== void 0) {
     console.log("  ARCHME_SANDBOX_SLOTS is no longer read; sandbox slots follow MAX_CONCURRENT_JOBS");
   }
-  console.log(`  sandbox: ${sandboxSettings.mode}${sandboxSettings.mode === "shadow" ? ` (projects: ${sandboxSettings.projects.size ? [...sandboxSettings.projects].join(", ") : "all"}; ${sandboxSettings.slots} slot(s))` : ""}`);
+  console.log(`  sandbox: ${sandboxSettings.mode}${sandboxSettings.mode === "shadow" ? ` (projects: ${sandboxSettings.projects.size ? [...sandboxSettings.projects].join(", ") : "all"}; ${sandboxSettings.slots} slot(s))` : sandboxSettings.mode === "required" ? ` (every diff/PR job boxed; ${sandboxSettings.slots} slot(s))` : ""}`);
+  if (sandboxSettings.mode === "required" && process.env.ARCHME_SANDBOX_PROJECTS?.trim()) {
+    console.log("  ARCHME_SANDBOX_PROJECTS is ignored in required mode: every project's jobs run boxed");
+  }
   const bearerCfg = {
     supabaseUrl: SUPABASE_URL,
     anonKey: SUPABASE_ANON_KEY,
@@ -22323,7 +22903,7 @@ async function runDaemon() {
   if (sandboxSettings.mode !== "off") {
     try {
       const { createSandboxParts: createSandboxParts2 } = await Promise.resolve().then(() => (init_parts(), parts_exports));
-      const { host } = await bootSandbox(sandboxSettings, createSandboxParts2(sandboxSettings), {
+      const { host, monitor } = await bootSandbox(sandboxSettings, createSandboxParts2(sandboxSettings), {
         mcpBaseUrl: ARCHME_MCP_BASE_URL,
         // The MCP gatekeeper re-mints a job's token before it expires (§7.2),
         // with the device that claimed that job, as every job-scoped call must.
@@ -22337,6 +22917,8 @@ async function runDaemon() {
         log: (m) => console.log(m)
       });
       sandboxHost = host;
+      monitor.start();
+      confinementGate = monitor;
     } catch (err4) {
       const msg = err4 instanceof Error ? err4.message : String(err4);
       if (sandboxBootFailurePolicy(sandboxSettings.mode) === "run_unboxed") {
@@ -22465,6 +23047,7 @@ ${signal} received, shutting down`);
     for (const ctx of sessions) ctx.auth.clearRefreshTimer();
     clearInterval(sweepTimer);
     clearInterval(localPollTimer);
+    confinementGate?.stop?.();
     for (const u2 of unsubscribers) u2();
     const SHUTDOWN_DEADLINE_MS = 3e4;
     const deadline = setTimeout(() => {
@@ -22507,7 +23090,7 @@ ${signal} received, shutting down`);
   process.on("SIGINT", () => shutdown("SIGINT"));
   process.on("SIGTERM", () => shutdown("SIGTERM"));
 }
-var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
+var HEARTBEAT_INTERVAL_MS, CLAUDE_TIMEOUT_MS, CLAUDE_LARGE_DIFF_TIMEOUT_MS, SAFETY_SWEEP_MS, LOG_STDOUT_CAP_BYTES, LOG_STDERR_CAP_BYTES, FAILURE_DETAIL_MAX, AUTH_PAUSE_MS, ClaudeRunError, PRE_SPAWN_TOKEN_MIN_LIFETIME_MS, SUPABASE_URL, SUPABASE_ANON_KEY, ARCHME_DAEMON_CLIENT_ID, ARCHME_MCP_BASE_URL, CLONE_BASE_DIR, DAEMON_ID, LEASE_SECONDS, inFlight, cancelled, killReasons, activeCleanups, cloneMutex, shuttingDown, daemonVersion, pauseUntilMs, resumeTimer, currentSched, MAX_CONCURRENT_JOBS, ctxByJob, deviceByJob, sandboxHost, confinementGate, boxedJobs, leaseLost, prefetchOverride, DEFAULT_CLONE_BASE_DIR, JOB_TOKEN_PREFIX, INLINE_PATCH_BYTE_CAP, GIT_SHA_RE, CURATOR_PREAMBLE, CORE_PRINCIPLES, STORY_COVERAGE_GATE, NEW_STORY_GUIDANCE, STORY_DESCRIPTION_EDIT_RULE, PHASE_GUIDANCE, BASE_RULES, DIFF_RULES, finite, channelSeq, MultipleAccountsError, __testDispatch;
 var init_run = __esm({
   "src/daemon/run.ts"() {
     "use strict";
@@ -22587,6 +23170,7 @@ var init_run = __esm({
     ctxByJob = /* @__PURE__ */ new Map();
     deviceByJob = /* @__PURE__ */ new Map();
     sandboxHost = null;
+    confinementGate = null;
     boxedJobs = /* @__PURE__ */ new Set();
     leaseLost = /* @__PURE__ */ new Set();
     prefetchOverride = null;
@@ -22767,6 +23351,9 @@ ${ANCHOR_VERIFICATION}`;
         sandboxHost = host;
         prefetchOverride = prefetch;
       },
+      setConfinementGate(gate) {
+        confinementGate = gate;
+      },
       // Daemon-version hooks for tests / introspection. The real value is
       // populated at runDaemon boot from package.json; tests can stub.
       setDaemonVersion(v) {
@@ -22779,13 +23366,450 @@ ${ANCHOR_VERIFICATION}`;
   }
 });
 
+// src/daemon/sandbox/pfAnchor.ts
+function renderAnchor() {
+  const slotLines = Array.from({ length: MAX_SLOTS }, (_, i2) => {
+    const s = slotFor(i2);
+    return `pass in quick inet proto tcp from ${s.subnet} to ${s.gateway} port ${PORTS} keep state`;
+  });
+  return [
+    `# ${ANCHOR_NAME} \u2014 installed by \`archme daemon sandbox setup\` (L2 \xA78.2).`,
+    "# DHCP inside each slot",
+    "pass in quick inet proto udp from any port 68 to any port 67",
+    "# each slot may reach only its own gateway, only on the gatekeeper ports",
+    ...slotLines,
+    "# everything else from a slot: host services on any host address, forwarding",
+    `block drop in quick inet from ${SLOT_RANGE} to any`,
+    "# the gatekeepers listen on the wildcard: nobody but a slot reaches them",
+    `block drop in quick inet proto tcp from any to any port ${PORTS}`,
+    ""
+  ].join("\n");
+}
+function addAnchorToPfConf(text) {
+  const lines = text.replace(/\n$/, "").split("\n");
+  if (ANCHOR_LINES.every((l) => lines.some((x) => x.trim() === l))) return { text, changed: false };
+  const kept = lines.filter((x) => !ANCHOR_LINES.includes(x.trim()));
+  let at = -1;
+  kept.forEach((l, i2) => {
+    if (!l.trim().startsWith("#") && l.includes("com.apple")) at = i2;
+  });
+  const insertAt = at >= 0 ? at + 1 : kept.length;
+  kept.splice(insertAt, 0, ...ANCHOR_LINES);
+  return { text: `${kept.join("\n")}
+`, changed: true };
+}
+function renderPfLaunchDaemon() {
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${PF_DAEMON_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/sbin/pfctl</string>
+        <string>-E</string>
+        <string>-f</string>
+        <string>${PF_CONF_PATH}</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+</dict>
+</plist>
+`;
+}
+function parseDestination(dest) {
+  const [addr, bitsStr] = dest.split("/");
+  if (!addr || !/^\d+(\.\d+){0,3}$/.test(addr)) return null;
+  const octets = addr.split(".");
+  const bits = bitsStr !== void 0 ? Number(bitsStr) : octets.length * 8;
+  while (octets.length < 4) octets.push("0");
+  const base = parseIpv4(octets.join("."));
+  if (base === null || !Number.isInteger(bits) || bits <= 0 || bits > 32) return null;
+  return { base, bits };
+}
+function mask(bits) {
+  return bits === 0 ? 0 : ~0 << 32 - bits >>> 0;
+}
+function overlaps(a2, b) {
+  const m = mask(Math.min(a2.bits, b.bits));
+  return (a2.base & m) >>> 0 === (b.base & m) >>> 0;
+}
+function within(inner, outer) {
+  return inner.bits >= outer.bits && overlaps(inner, outer);
+}
+function routeCollisions(netstat, ourSlots2) {
+  const range2 = parseDestination(SLOT_RANGE.replace(".0/21", "/21"));
+  const ours = [...ourSlots2].map((i2) => parseDestination(slotFor(i2).subnet.replace(".0/24", "/24")));
+  const out = [];
+  for (const line of netstat.split("\n")) {
+    const cols = line.trim().split(/\s+/);
+    const net3 = parseDestination(cols[0] ?? "");
+    if (!net3 || !overlaps(net3, range2)) continue;
+    if (ours.some((o2) => within(net3, o2))) continue;
+    out.push(`${cols[0]} via ${cols[3] ?? "?"}`);
+  }
+  return out;
+}
+function bakedUnitEnv(plist) {
+  const m = /<key>EnvironmentVariables<\/key>\s*<dict>([\s\S]*?)<\/dict>/.exec(plist);
+  if (!m) return {};
+  const out = {};
+  const unescape2 = (s) => s.replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, '"').replace(/&apos;/g, "'").replace(/&amp;/g, "&");
+  for (const kv of m[1].matchAll(/<key>([^<]*)<\/key>\s*<string>([^<]*)<\/string>/g)) {
+    out[unescape2(kv[1])] = unescape2(kv[2]);
+  }
+  return out;
+}
+var ANCHOR_NAME, ANCHOR_PATH, PF_CONF_PATH, PF_CONF_BACKUP_PATH, PF_DAEMON_LABEL, PF_DAEMON_PATH, SLOT_RANGE, PORTS, ANCHOR_LINES;
+var init_pfAnchor = __esm({
+  "src/daemon/sandbox/pfAnchor.ts"() {
+    "use strict";
+    init_appleContainer();
+    init_slotMap();
+    init_types();
+    ANCHOR_NAME = "com.archme.sandbox";
+    ANCHOR_PATH = `/etc/pf.anchors/${ANCHOR_NAME}`;
+    PF_CONF_PATH = "/etc/pf.conf";
+    PF_CONF_BACKUP_PATH = "/etc/pf.conf.archme-backup";
+    PF_DAEMON_LABEL = "com.archme.pf";
+    PF_DAEMON_PATH = `/Library/LaunchDaemons/${PF_DAEMON_LABEL}.plist`;
+    SLOT_RANGE = `192.168.${SLOT_RANGE_BASE_THIRD_OCTET}.0/21`;
+    PORTS = `{ ${GATE_PORTS.anthropic} ${GATE_PORTS.mcp} ${GATE_PORTS.github} }`;
+    ANCHOR_LINES = [
+      `anchor "${ANCHOR_NAME}"`,
+      `load anchor "${ANCHOR_NAME}" from "${ANCHOR_PATH}"`
+    ];
+  }
+});
+
+// src/daemon/sandbox/setupCommand.ts
+var setupCommand_exports = {};
+__export(setupCommand_exports, {
+  HARDENING_TEXT: () => HARDENING_TEXT,
+  runSandboxSetup: () => runSandboxSetup,
+  runSandboxStatus: () => runSandboxStatus
+});
+async function checkHost(io) {
+  const ver = (await io.run("sw_vers", ["-productVersion"])).stdout.trim();
+  const major = Number(ver.split(".")[0]);
+  if (!(major >= 26)) return `macOS 26 or later is required (this is ${ver || "not macOS"})`;
+  const arch = (await io.run("uname", ["-m"])).stdout.trim();
+  if (arch !== "arm64") return `Apple Silicon is required (this is ${arch || "unknown"})`;
+  if (!await runtimeUp(io)) return "Apple `container` is not running; start it with `container system start`";
+  return null;
+}
+async function runtimeUp(io) {
+  const s = await io.run("container", ["system", "status"]);
+  return s.exitCode === 0 && /^status\s+running\b/m.test(s.stdout);
+}
+async function ourSlots(io) {
+  const nets = await io.listNetworks();
+  const ours = /* @__PURE__ */ new Set();
+  for (let i2 = 0; i2 < MAX_SLOTS; i2++) {
+    const s = slotFor(i2);
+    if (nets.some((n2) => n2.name === s.network && n2.subnet === s.subnet)) ours.add(i2);
+  }
+  return ours;
+}
+async function currentMode(io) {
+  const unit = await io.unitEnv();
+  if (unit) return { mode: unit.ARCHME_SANDBOX?.trim() || "off", from: "installed service" };
+  return { mode: io.env.ARCHME_SANDBOX?.trim() || "off", from: "this shell" };
+}
+async function runSandboxSetup(io, opts) {
+  const fail2 = (msg) => {
+    io.print(`\u2717 ${msg}`);
+    return 1;
+  };
+  const host = await checkHost(io);
+  if (host) return fail2(host);
+  io.print("\u2713 macOS 26+, Apple Silicon, container running");
+  if (!io.image) return fail2("no sandbox image: this install ships no sandbox-image.json, so set ARCHME_SANDBOX_IMAGE");
+  if ((await io.run("container", ["image", "inspect", io.image])).exitCode !== 0) {
+    io.print(`Pulling ${io.image}\u2026`);
+    const pull = await io.run("container", ["image", "pull", io.image]);
+    if (pull.exitCode !== 0) return fail2(`image pull failed: ${pull.stderr.trim()}`);
+  }
+  io.print(`\u2713 image ${io.image}`);
+  const existing = await io.readToken().catch(() => null);
+  const keep = existing && (opts.yes || await io.confirm(`A Claude token is stored (${existing.source}). Keep it?`));
+  if (keep) {
+    io.print(`\u2713 Claude token (${existing.source})`);
+  } else {
+    io.print("Run `claude setup-token` and paste the token it prints (input is hidden).");
+    const stored = await io.storeToken(await io.promptSecret("Claude setup token: "));
+    io.print(`\u2713 Claude token stored in ${stored.source === "keychain" ? "the macOS keychain" : "a 0600 file"}${stored.note ? ` (${stored.note})` : ""}`);
+  }
+  const netstat = await io.run("netstat", ["-rn", "-f", "inet"]);
+  if (netstat.exitCode !== 0) return fail2(`netstat failed: ${netstat.stderr.trim()}`);
+  const collisions = routeCollisions(netstat.stdout, await ourSlots(io));
+  if (collisions.length) {
+    return fail2(`the slot range 192.168.240.0/21 is already routed: ${collisions.join(", ")}. Free it (a VPN or another VM tool) and re-run.`);
+  }
+  await io.ensureSlots(MAX_SLOTS);
+  io.print(`\u2713 ${MAX_SLOTS} slot networks`);
+  const anchor = renderAnchor();
+  const plist = renderPfLaunchDaemon();
+  const pfConf = await io.readFile(PF_CONF_PATH);
+  if (pfConf === null) return fail2(`cannot read ${PF_CONF_PATH}`);
+  const conf = addAnchorToPfConf(pfConf);
+  const anchorChanged = await io.readFile(ANCHOR_PATH) !== anchor;
+  const plistChanged = await io.readFile(PF_DAEMON_PATH) !== plist;
+  const pfUnchanged = !anchorChanged && !conf.changed && !plistChanged;
+  const reload = [
+    // Not loaded yet on a first run.
+    { args: ["launchctl", "bootout", `system/${PF_DAEMON_LABEL}`], mayFail: true },
+    // RunAtLoad: this applies the rules now.
+    { args: ["launchctl", "bootstrap", "system", PF_DAEMON_PATH] }
+  ];
+  const runSudo = async (steps) => {
+    for (const s of steps) {
+      io.print(`$ sudo ${s.args.join(" ")}`);
+      const r = await io.sudo(s.args);
+      if (r.exitCode !== 0 && !s.mayFail) return `\`sudo ${s.args.join(" ")}\` failed (exit ${r.exitCode}); nothing after it ran`;
+    }
+    await io.sleep(2e3);
+    return null;
+  };
+  if (pfUnchanged) {
+    io.print("\u2713 pf: already installed");
+  } else {
+    io.print(`
+These rules go in ${ANCHOR_PATH}:
+`);
+    for (const l of anchor.trimEnd().split("\n")) io.print(`    ${l}`);
+    if (conf.changed) {
+      io.print(`
+${PF_CONF_PATH} gains (a backup goes to ${PF_CONF_BACKUP_PATH}):
+`);
+      const before = new Set(pfConf.split("\n"));
+      for (const l of conf.text.split("\n")) if (l && !before.has(l)) io.print(`    + ${l}`);
+    }
+    io.print(`
+${PF_DAEMON_PATH} enables pf and loads ${PF_CONF_PATH} at every boot (${PF_DAEMON_LABEL}).
+`);
+    if (!opts.yes && !await io.confirm("Install these with sudo?")) return fail2("pf not installed");
+    const anchorTmp = await io.writeTemp("com.archme.sandbox", anchor);
+    const confTmp = await io.writeTemp("pf.conf", conf.text);
+    const plistTmp = await io.writeTemp(`${PF_DAEMON_LABEL}.plist`, plist);
+    const steps = [
+      { args: sudoInstall(anchorTmp, ANCHOR_PATH) },
+      // Validate the new pf.conf (it loads the anchor just installed) before it replaces the old.
+      { args: ["pfctl", "-nf", confTmp] },
+      ...conf.changed ? [{ args: ["cp", PF_CONF_PATH, PF_CONF_BACKUP_PATH] }, { args: sudoInstall(confTmp, PF_CONF_PATH) }] : [],
+      { args: sudoInstall(plistTmp, PF_DAEMON_PATH) },
+      ...reload
+    ];
+    const err4 = await runSudo(steps);
+    if (err4) return fail2(err4);
+    io.print("\u2713 pf installed");
+  }
+  io.print("");
+  let code = await runSandboxStatus(io);
+  if (code !== 0 && pfUnchanged && (opts.yes || await io.confirm("Reload pf from the installed files with sudo?"))) {
+    const err4 = await runSudo(reload);
+    if (err4) return fail2(err4);
+    io.print("");
+    code = await runSandboxStatus(io);
+  }
+  const { mode, from } = await currentMode(io);
+  io.print("");
+  io.print(`ARCHME_SANDBOX is ${mode} (${from}); setup does not change it.`);
+  io.print("To require confinement for every job: set ARCHME_SANDBOX=required in the daemon's environment, then `archme daemon restart`.");
+  for (const l of HARDENING_TEXT) io.print(l);
+  return code;
+}
+async function runSandboxStatus(io) {
+  let ok = true;
+  const line = (good, name, detail) => {
+    if (!good) ok = false;
+    io.print(`${good ? "\u2713" : "\u2717"} ${name.padEnd(9)} ${detail}`);
+  };
+  const up = await runtimeUp(io);
+  line(up, "runtime", up ? "container running" : "container is not running");
+  if (io.image) {
+    const present = up && (await io.run("container", ["image", "inspect", io.image])).exitCode === 0;
+    line(present, "image", `${io.image}${present ? "" : " (not present: run `archme daemon sandbox setup`)"}`);
+  } else {
+    line(false, "image", "none configured (no sandbox-image.json and no ARCHME_SANDBOX_IMAGE)");
+  }
+  try {
+    const t = await io.readToken();
+    line(true, "token", t.source === "keychain" ? "macOS keychain" : t.source === "file-override" ? "ARCHME_SANDBOX_CLAUDE_TOKEN_FILE" : "file");
+  } catch (e) {
+    line(false, "token", e.message);
+  }
+  const ours = up ? await ourSlots(io) : /* @__PURE__ */ new Set();
+  const missing = Array.from({ length: MAX_SLOTS }, (_, i2) => i2).filter((i2) => !ours.has(i2)).map((i2) => slotFor(i2).network);
+  line(missing.length === 0, "slots", missing.length ? `missing: ${missing.join(", ")}` : `${MAX_SLOTS} slot networks`);
+  let probeSlot = null;
+  if (up) {
+    const busy = new Set((await io.listBoxes()).map((b) => b.labels[SLOT_LABEL]).filter((x) => !!x));
+    for (let i2 = MAX_SLOTS - 1; i2 >= 0; i2--) {
+      if (ours.has(i2) && !busy.has(String(i2))) {
+        probeSlot = slotFor(i2);
+        break;
+      }
+    }
+  }
+  if (!probeSlot) {
+    line(false, "probe", "not run: no free slot network");
+  } else {
+    const r = await io.probe(probeSlot);
+    line(r.ok, "probe", formatConfinementReport(r));
+    for (const [id, o2] of Object.entries(r.outcomes)) io.print(`            ${id.padEnd(15)} ${o2}`);
+  }
+  const { mode, from } = await currentMode(io);
+  io.print(`  mode      ${mode} (${from})`);
+  return ok ? 0 : 1;
+}
+var HARDENING_TEXT, sudoInstall;
+var init_setupCommand = __esm({
+  "src/daemon/sandbox/setupCommand.ts"() {
+    "use strict";
+    init_appleContainer();
+    init_confinement();
+    init_pfAnchor();
+    init_types();
+    HARDENING_TEXT = [
+      "Host hardening (L2 \xA78.5), by hand:",
+      "  - turn off SSH password authentication (PasswordAuthentication no in /etc/ssh/sshd_config)",
+      "  - keep AirPlay Receiver off (System Settings \u2192 General \u2192 AirDrop & Handoff)"
+    ];
+    sudoInstall = (from, to) => ["install", "-m", "644", "-o", "root", "-g", "wheel", from, to];
+  }
+});
+
+// src/daemon/sandbox/setupIo.ts
+var setupIo_exports = {};
+__export(setupIo_exports, {
+  createSetupIo: () => createSetupIo
+});
+import { mkdtemp as mkdtemp5, readFile as readFile15, writeFile as writeFile14 } from "node:fs/promises";
+import { networkInterfaces as networkInterfaces2, tmpdir as tmpdir5 } from "node:os";
+import { join as join25 } from "node:path";
+import { createInterface as createInterface2 } from "node:readline";
+import { Writable as Writable4 } from "node:stream";
+function ask(question, hidden2 = false) {
+  let muted = false;
+  const output = new Writable4({
+    write(chunk, _enc, cb) {
+      if (!muted) process.stdout.write(chunk);
+      cb();
+    }
+  });
+  const rl = createInterface2({ input: process.stdin, output, terminal: true });
+  return new Promise((resolve7) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      if (hidden2) process.stdout.write("\n");
+      resolve7(answer);
+    });
+    muted = hidden2;
+  });
+}
+function createSetupIo(env = process.env) {
+  let image = null;
+  try {
+    image = resolveSandboxImage(env, () => readShippedImage());
+  } catch {
+    image = null;
+  }
+  const runtime = new AppleContainerRuntime({ image: image ?? void 0 });
+  const token = sandboxTokenLocation(env);
+  let tempDir = null;
+  return {
+    env,
+    image,
+    run: async (cmd, args) => {
+      const r = await execa(cmd, args, { reject: false, stdin: "ignore" });
+      return {
+        exitCode: r.exitCode ?? -1,
+        stdout: typeof r.stdout === "string" ? r.stdout : "",
+        stderr: typeof r.stderr === "string" ? r.stderr : r.message ?? ""
+      };
+    },
+    // On the terminal: sudo may ask for a password.
+    sudo: async (args) => {
+      const r = await execa("sudo", args, { reject: false, stdio: "inherit" });
+      return { exitCode: r.exitCode ?? -1, stdout: "", stderr: "" };
+    },
+    print: (line) => console.log(line),
+    confirm: async (q) => !/^n/i.test((await ask(`${q} [Y/n] `)).trim()),
+    promptSecret: (q) => ask(q, true),
+    readFile: (p) => readFile15(p, "utf8").catch(() => null),
+    writeTemp: async (name, content) => {
+      tempDir ??= await mkdtemp5(join25(tmpdir5(), "archme-sandbox-setup-"));
+      const p = join25(tempDir, name);
+      await writeFile14(p, content, { mode: 420 });
+      return p;
+    },
+    sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
+    listNetworks: () => runtime.listNetworks(),
+    ensureSlots: async (n2) => {
+      await runtime.ensureSlots(n2);
+    },
+    listBoxes: () => runtime.list(),
+    readToken: () => readSandboxClaudeToken({ claudeTokenPath: token.path, claudeTokenOverride: token.override }),
+    storeToken: (t) => storeSandboxClaudeToken(t, { path: token.path, override: token.override }),
+    probe: async (slot) => {
+      if (!image) return { ok: false, slot: slot.index, failures: ["no sandbox image"], outcomes: {}, ms: 0 };
+      const gates = new GatekeeperSet({
+        slots: Array.from({ length: MAX_SLOTS }, (_, i2) => slotFor(i2)),
+        getClaudeToken: () => "status-probe-has-no-token",
+        mcpUpstream: "http://127.0.0.1:9/functions/v1/mcp",
+        remint: async () => {
+          throw new Error("no job");
+        },
+        logger: () => {
+        }
+      });
+      let own = false;
+      try {
+        await gates.start();
+        own = true;
+      } catch {
+        console.log("  (the daemon's gatekeepers are answering)");
+      }
+      try {
+        return await runConfinementProbe({ runtime, image }, slot, primaryLanIpv4(networkInterfaces2()));
+      } finally {
+        if (own) await gates.stop();
+      }
+    },
+    unitEnv: async () => {
+      if (process.platform !== "darwin") return null;
+      const plist = await readFile15(resolveUnitPath("darwin", env), "utf8").catch(() => null);
+      return plist === null ? null : bakedUnitEnv(plist);
+    }
+  };
+}
+var init_setupIo = __esm({
+  "src/daemon/sandbox/setupIo.ts"() {
+    "use strict";
+    init_execa();
+    init_paths();
+    init_appleContainer();
+    init_claudeToken();
+    init_confinement();
+    init_imageManifest();
+    init_pfAnchor();
+    init_setting();
+    init_slots();
+    init_types();
+  }
+});
+
 // src/daemon/service/dispatch.ts
 var dispatch_exports2 = {};
 __export(dispatch_exports2, {
   dispatchDaemon: () => dispatchDaemon
 });
 import { rm as rm9 } from "node:fs/promises";
-async function dispatchDaemon(route2) {
+async function dispatchDaemon(route2, deps = {}) {
+  const { platform: platform3, env } = deps;
+  const controller = () => deps.controller ?? pickController(platform3, env);
   switch (route2.action) {
     case "help":
       printDaemonHelp();
@@ -22803,7 +23827,7 @@ async function dispatchDaemon(route2) {
     }
     case "start": {
       try {
-        const out = await runStartFlow({ noLogin: route2.noLogin });
+        const out = await runStartFlow({ noLogin: route2.noLogin, controller: controller(), platform: platform3, env });
         console.log(
           `${out.result.actions.includes("installed") ? "Installing " : out.result.actions.includes("reinstalled") ? "Reinstalling " : ""}service\u2026`
         );
@@ -22816,58 +23840,82 @@ async function dispatchDaemon(route2) {
           console.error(String(err4.message));
           return 75;
         }
+        if (err4 instanceof CredentialStoreUnreadableError) {
+          console.error(err4.message);
+          console.error(
+            "The daemon service is NOT running (no service is installed, so nothing vouches for an earlier sign-in). Unlock the keychain and run `archme daemon start` again, or run it from the desktop session."
+          );
+          return 1;
+        }
         console.error(String(err4));
         return 1;
       }
     }
     case "stop": {
-      const c3 = pickController();
+      const c3 = controller();
       await orchestrateStop(c3);
       console.log("Stopped.");
       return 0;
     }
     case "restart": {
       try {
-        await ensureStartPrerequisites({ noLogin: route2.noLogin });
+        await ensureStartPrerequisites({ noLogin: route2.noLogin, controller: controller(), platform: platform3, env });
       } catch (err4) {
         if (err4 instanceof NotSignedInError) {
           console.error(String(err4.message));
           console.error("(daemon left running unchanged)");
           return 75;
         }
-        console.error(String(err4));
+        console.error(err4 instanceof CredentialStoreUnreadableError ? err4.message : String(err4));
         console.error("(daemon left running unchanged)");
         return 1;
       }
-      const c3 = pickController();
+      const c3 = controller();
       await orchestrateStop(c3);
-      const out = await runStartFlow({ noLogin: route2.noLogin });
+      const out = await runStartFlow({
+        noLogin: route2.noLogin,
+        controller: c3,
+        platform: platform3,
+        env,
+        isSignedIn: async () => true
+      });
       console.log(`Restarted (${out.result.actions.join(" \u2192 ")}).`);
       return 0;
     }
     case "status": {
-      const c3 = pickController();
       const status = await gatherStatus({
-        controller: c3,
+        controller: controller(),
         loadCredentials: defaultLoadCredentials,
         loadSupabaseState: defaultLoadSupabaseState,
-        loadUptime: defaultLoadUptime
+        loadUptime: defaultLoadUptime,
+        platform: platform3,
+        env
       });
       const out = renderStatus(status);
-      process.stdout.write(out.rendered);
+      (deps.stdout ?? process.stdout).write(out.rendered);
       return out.exitCode;
     }
+    case "sandbox-setup": {
+      const { runSandboxSetup: runSandboxSetup2 } = await Promise.resolve().then(() => (init_setupCommand(), setupCommand_exports));
+      const { createSetupIo: createSetupIo2 } = await Promise.resolve().then(() => (init_setupIo(), setupIo_exports));
+      return await runSandboxSetup2(createSetupIo2(), { yes: route2.yes });
+    }
+    case "sandbox-status": {
+      const { runSandboxStatus: runSandboxStatus2 } = await Promise.resolve().then(() => (init_setupCommand(), setupCommand_exports));
+      const { createSetupIo: createSetupIo2 } = await Promise.resolve().then(() => (init_setupIo(), setupIo_exports));
+      return await runSandboxStatus2(createSetupIo2());
+    }
     case "logs":
       await tailLog({ lines: route2.lines, follow: route2.follow });
       return 0;
     case "enable": {
-      const c3 = pickController();
+      const c3 = controller();
       await c3.enable();
       console.log("Enabled at login.");
       return 0;
     }
     case "disable": {
-      const c3 = pickController();
+      const c3 = controller();
       await c3.disable();
       console.log("Disabled at login. Existing instance keeps running until `archme daemon stop`.");
       return 0;
@@ -22878,7 +23926,7 @@ async function dispatchDaemon(route2) {
       return 0;
     }
     case "uninstall": {
-      const c3 = pickController();
+      const c3 = controller();
       await orchestrateStop(c3);
       await c3.uninstall();
       if (route2.purge) {
@@ -22900,7 +23948,13 @@ async function defaultLoadCredentials() {
     return null;
   }
   const { loadCredentials: loadCredentials2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
-  const { credentials } = await loadCredentials2(supabaseUrl);
+  let credentials;
+  try {
+    ({ credentials } = await loadCredentials2(supabaseUrl));
+  } catch (err4) {
+    if (err4 instanceof CredentialStoreUnreadableError) return { unreadable: err4.message };
+    throw err4;
+  }
   if (!credentials) return null;
   const email = decodeJwtEmail(credentials.access_token) ?? credentials.user_id ?? null;
   return { email, deviceId: credentials.device_id ?? null };
@@ -22923,8 +23977,8 @@ async function defaultLoadSupabaseState(_deviceId) {
 async function defaultLoadUptime(pid) {
   if (process.platform === "linux") {
     try {
-      const { readFile: readFile19 } = await import("node:fs/promises");
-      const stat12 = await readFile19(`/proc/${pid}/stat`, "utf8");
+      const { readFile: readFile20 } = await import("node:fs/promises");
+      const stat12 = await readFile20(`/proc/${pid}/stat`, "utf8");
       const parts = stat12.split(") ").pop()?.split(" ") ?? [];
       const ticks = Number(parts[19]);
       if (!Number.isFinite(ticks)) return null;
@@ -22967,6 +24021,8 @@ Usage:
   archme daemon install [--no-login]    Write unit file, do not load
   archme daemon uninstall [--purge]     Unload + remove unit (logs kept; --purge removes them too)
   archme daemon run                     Foreground worker (what the service unit invokes)
+  archme daemon sandbox setup [--yes]   Once per machine: image, Claude token, slot networks, pf (sudo)
+  archme daemon sandbox status          Check the sandbox confinement holds (runs a probe box)
 `);
 }
 var init_dispatch2 = __esm({
@@ -22977,6 +24033,7 @@ var init_dispatch2 = __esm({
     init_logs();
     init_status();
     init_paths();
+    init_credentials();
   }
 });
 
@@ -23035,6 +24092,7 @@ async function createAuthedClient(opts) {
   try {
     loaded = await loadStoredAndRefresh();
   } catch (err4) {
+    if (err4 instanceof CredentialStoreError) throw err4;
     const msg = err4 instanceof Error ? err4.message : String(err4);
     throw new Error(`${msg}
 \u2192 run \`archme login\` first`);
@@ -23063,6 +24121,7 @@ var init_authedClient = __esm({
     "use strict";
     init_bearer();
     init_identity();
+    init_credentials();
     SCAN_CLAUDE_TIMEOUT_MS = 45 * 60 * 1e3;
     SCAN_PRE_SPAWN_TOKEN_MIN_LIFETIME_MS = SCAN_CLAUDE_TIMEOUT_MS + 5 * 60 * 1e3;
     ORCHESTRATED_SCAN_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
@@ -23114,8 +24173,8 @@ __export(open_exports, {
   runOpen: () => runOpen,
   safeNextPath: () => safeNextPath
 });
-import { readFile as readFile15 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { readFile as readFile16 } from "node:fs/promises";
+import { join as join26 } from "node:path";
 function safeNextPath(path7) {
   if (!path7 || !path7.startsWith("/") || path7.startsWith("//") || path7.startsWith("/\\")) return "/";
   return path7;
@@ -23202,7 +24261,7 @@ async function defaultOpenBrowser(url) {
 }
 async function defaultReadMcpJson(cwd) {
   try {
-    return await readFile15(join25(cwd, ".mcp.json"), "utf8");
+    return await readFile16(join26(cwd, ".mcp.json"), "utf8");
   } catch {
     return null;
   }
@@ -23299,7 +24358,14 @@ function pickKey(keys, handle, active) {
 }
 async function runKey(cmd, deps) {
   const keys = await deps.listKeys();
-  const active = await deps.loadActive();
+  let active;
+  try {
+    active = await deps.loadActive();
+  } catch (err4) {
+    if (!(err4 instanceof CredentialStoreError)) throw err4;
+    deps.error(`${err4.message} Which key is signed in can't be shown.`);
+    active = null;
+  }
   if (cmd.action === "list") {
     if (keys.length === 0) {
       deps.log("No saved keys on this machine.");
@@ -23369,6 +24435,7 @@ Usage: archme key [list|show|forget] [--handle <handle>] [--yes]`);
 var init_key = __esm({
   "src/account/key.ts"() {
     "use strict";
+    init_credentials();
   }
 });
 
@@ -23562,8 +24629,8 @@ var init_transcript_signals = __esm({
 });
 
 // src/scan/report.ts
-import { mkdir as mkdir14, writeFile as writeFile14 } from "node:fs/promises";
-import { dirname as dirname16 } from "node:path";
+import { mkdir as mkdir15, writeFile as writeFile15 } from "node:fs/promises";
+import { dirname as dirname17 } from "node:path";
 async function buildReport(input) {
   return {
     schema_version: REPORT_SCHEMA_VERSION,
@@ -23597,10 +24664,10 @@ async function buildReport(input) {
   };
 }
 async function writeReport(reportPath, orphansTxtPath, report, orphansFull) {
-  await mkdir14(dirname16(reportPath), { recursive: true });
-  await writeFile14(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8");
-  await mkdir14(dirname16(orphansTxtPath), { recursive: true });
-  await writeFile14(
+  await mkdir15(dirname17(reportPath), { recursive: true });
+  await writeFile15(reportPath, JSON.stringify(report, null, 2) + "\n", "utf8");
+  await mkdir15(dirname17(orphansTxtPath), { recursive: true });
+  await writeFile15(
     orphansTxtPath,
     orphansFull.join("\n") + (orphansFull.length ? "\n" : ""),
     "utf8"
@@ -23644,8 +24711,8 @@ var init_claimDefaultProject = __esm({
 // src/scan/run-scan.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
 import { createWriteStream as createWriteStream2 } from "node:fs";
-import { mkdir as mkdir15, readFile as readFile16, writeFile as writeFile15 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname17, join as join26 } from "node:path";
+import { mkdir as mkdir16, readFile as readFile17, writeFile as writeFile16 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname18, join as join27 } from "node:path";
 function modeInstruction(opts) {
   const line = modeLine(opts);
   if (opts.mode === "orchestrator" && opts.plan) {
@@ -23701,13 +24768,13 @@ Use scan-prompt variant \`${promptVariant}\` \u2014 pass \`variant: "${promptVar
   return base;
 }
 async function writeScanSession(repoPath, session) {
-  const path7 = join26(repoPath, SCAN_SESSION_FILE);
-  await mkdir15(dirname17(path7), { recursive: true });
-  await writeFile15(path7, JSON.stringify(session, null, 2) + "\n");
+  const path7 = join27(repoPath, SCAN_SESSION_FILE);
+  await mkdir16(dirname18(path7), { recursive: true });
+  await writeFile16(path7, JSON.stringify(session, null, 2) + "\n");
 }
 async function readScanSession(repoPath) {
-  const path7 = join26(repoPath, SCAN_SESSION_FILE);
-  const raw = await readFile16(path7, "utf8").catch(() => null);
+  const path7 = join27(repoPath, SCAN_SESSION_FILE);
+  const raw = await readFile17(path7, "utf8").catch(() => null);
   if (raw === null) throw new Error(`no scan session to resume at ${path7} \u2014 launch it instead`);
   let parsed;
   try {
@@ -24098,9 +25165,9 @@ async function runScan(opts, deps = {}) {
       // Incompatible with an interactive TTY session.
       streamJson: !interactive
     });
-    const transcriptDir = join26(opts.repoPath, ".archme", "scan");
-    const transcriptPath = join26(transcriptDir, "transcript.log");
-    await mkdir15(transcriptDir, { recursive: true });
+    const transcriptDir = join27(opts.repoPath, ".archme", "scan");
+    const transcriptPath = join27(transcriptDir, "transcript.log");
+    await mkdir16(transcriptDir, { recursive: true });
     const transcriptStream = createWriteStream2(transcriptPath, { flags: opts.resume ? "a" : "w" });
     let finalResultText = "";
     const echo = opts.echo ?? ((line) => process.stdout.write(line + "\n"));
@@ -24143,9 +25210,9 @@ async function runScan(opts, deps = {}) {
       await new Promise((resolve7, reject) => {
         transcriptStream.end((err4) => err4 ? reject(err4) : resolve7());
       });
-      const reportPath = join26(transcriptDir, "report.json");
-      const orphansTxtPath = join26(transcriptDir, "orphans.txt");
-      const transcript = await readFile16(transcriptPath, "utf8").catch(() => "");
+      const reportPath = join27(transcriptDir, "report.json");
+      const orphansTxtPath = join27(transcriptDir, "orphans.txt");
+      const transcript = await readFile17(transcriptPath, "utf8").catch(() => "");
       signals2 = extractTranscriptSignals(transcript);
       const architecture = await fetchArchitectureDetail(supabase, resolved2.projectId, branchName2);
       const orphans = await classifyOrphans({
@@ -24299,7 +25366,7 @@ var init_scanOutcome = __esm({
 
 // src/init/repoSize.ts
 import { stat as stat9 } from "node:fs/promises";
-import { extname, join as join27 } from "node:path";
+import { extname, join as join28 } from "node:path";
 async function measureRepo(repoPath) {
   const files = await gitListFiles(repoPath);
   if (!files) return { sourceFiles: 0, sourceBytes: 0, totalFiles: 0 };
@@ -24308,7 +25375,7 @@ async function measureRepo(repoPath) {
   for (const rel of files) {
     if (!SOURCE_EXTENSIONS.has(extname(rel).toLowerCase())) continue;
     try {
-      const s = await stat9(join27(repoPath, rel));
+      const s = await stat9(join28(repoPath, rel));
       if (!s.isFile()) continue;
       sourceFiles++;
       sourceBytes += s.size;
@@ -24944,10 +26011,10 @@ __export(localWatch_exports, {
   watchLocalRepoRow: () => watchLocalRepoRow
 });
 import { homedir as homedir9 } from "node:os";
-import { join as join28, resolve as resolve2 } from "node:path";
+import { join as join29, resolve as resolve2 } from "node:path";
 import { stat as stat10 } from "node:fs/promises";
 function mirrorPathFor(cloneBaseDir, owner, name) {
-  return join28(cloneBaseDir, owner, name);
+  return join29(cloneBaseDir, owner, name);
 }
 function resolveInitTarget(input) {
   if (!input.originUrl) {
@@ -25119,7 +26186,7 @@ async function registerLocalWatch(args) {
   if (!watched.ok) return { ok: false, reason: watched.reason, exitCode: 3 };
   const { watchedRepoId } = watched;
   const mirrorPath = mirrorPathFor(cloneBaseDir, target.repoOwner, target.repoName);
-  const mirrorExists = await stat10(join28(mirrorPath, ".git")).then(() => true).catch(() => false);
+  const mirrorExists = await stat10(join29(mirrorPath, ".git")).then(() => true).catch(() => false);
   if (mirrorExists) {
     log(`  mirror:  ${mirrorPath} (reusing)`);
     await setOriginUrl(mirrorPath, originUrl);
@@ -25266,7 +26333,7 @@ var init_localWatch = __esm({
     init_localWatchResolve();
     init_prompt();
     init_localPrSetup();
-    DEFAULT_CLONE_BASE_DIR2 = join28(homedir9(), ".archme-job-runner", "clones");
+    DEFAULT_CLONE_BASE_DIR2 = join29(homedir9(), ".archme-job-runner", "clones");
   }
 });
 
@@ -25299,9 +26366,9 @@ var init_plan = __esm({
 });
 
 // src/init/run-init.ts
-import { mkdtemp as mkdtemp5, rm as rm10, writeFile as writeFile16 } from "node:fs/promises";
-import { tmpdir as tmpdir5 } from "node:os";
-import { join as join29 } from "node:path";
+import { mkdtemp as mkdtemp6, rm as rm10, writeFile as writeFile17 } from "node:fs/promises";
+import { tmpdir as tmpdir6 } from "node:os";
+import { join as join30 } from "node:path";
 async function defaultStartDaemon() {
   const { runStartFlow: runStartFlow2 } = await Promise.resolve().then(() => (init_install(), install_exports));
   const out = await runStartFlow2({ noLogin: true });
@@ -25346,10 +26413,10 @@ async function defaultFetchInstallScript(url) {
   return await resp.text();
 }
 async function defaultRunInstallScript(script, cwd) {
-  const dir = await mkdtemp5(join29(tmpdir5(), "archme-init-"));
-  const scriptPath = join29(dir, "install-agent.sh");
+  const dir = await mkdtemp6(join30(tmpdir6(), "archme-init-"));
+  const scriptPath = join30(dir, "install-agent.sh");
   try {
-    await writeFile16(scriptPath, script, { mode: 448 });
+    await writeFile17(scriptPath, script, { mode: 448 });
     await execa("sh", [scriptPath], { cwd, stdio: "inherit" });
   } finally {
     await rm10(dir, { recursive: true, force: true });
@@ -26895,11 +27962,11 @@ var init_dispatch3 = __esm({
 // src/init/prReviews.ts
 async function offerPrReviewsForInit(ctx, flag, deps = {}) {
   const readMode = deps.readMode ?? readPrReviewMode;
-  const ask = deps.ask ?? askForPrReviews;
+  const ask2 = deps.ask ?? askForPrReviews;
   const setMode = deps.setMode ?? setPrReviewMode;
   const ghLogin = deps.ghLogin ?? ghLoginPrompt;
   const current = await readMode(ctx.supabase, ctx.watchedRepoId);
-  const want = await ask({ flag, interactive: ctx.interactive, current });
+  const want = await ask2({ flag, interactive: ctx.interactive, current });
   if (want === null) {
     if (current === "auto") ctx.log(`\u2713 ${PR_REVIEWS_ALREADY_ON}`);
     return;
@@ -27325,7 +28392,7 @@ __export(run_uninstall_exports, {
   runUninstall: () => runUninstall
 });
 import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync6, rmSync, writeFileSync as writeFileSync3 } from "node:fs";
-import { join as join30 } from "node:path";
+import { join as join31 } from "node:path";
 function readIfExists(path7) {
   try {
     return existsSync3(path7) ? readFileSync6(path7, "utf8") : null;
@@ -27351,7 +28418,7 @@ async function runUninstall(opts) {
   const backend = opts.backend ?? await defaultBackend();
   const repoPath = await backend.gitRoot(opts.repoPath).catch(() => null) ?? opts.repoPath;
   if (repoPath !== opts.repoPath) log(`Using the repo root: ${repoPath}`);
-  const abs = (rel) => join30(repoPath, rel);
+  const abs = (rel) => join31(repoPath, rel);
   const actions = [];
   const skipped = [];
   const mcpRaw = readIfExists(abs(".mcp.json"));
@@ -27931,7 +28998,7 @@ __export(run_exports3, {
   watchedElsewhere: () => watchedElsewhere
 });
 import { readdir as readdir3, stat as stat11 } from "node:fs/promises";
-import { dirname as dirname18, join as join31, resolve as resolve6, sep as sep2 } from "node:path";
+import { dirname as dirname19, join as join32, resolve as resolve6, sep as sep2 } from "node:path";
 function isThisRunsWrite(metadata) {
   return metadata?.kind === "scan" || !!metadata?.repo_fold;
 }
@@ -27961,12 +29028,12 @@ async function listClones(dir) {
   const out = [];
   for (const e of entries) {
     if (!e.isDirectory() || e.name.startsWith(".")) continue;
-    if (await stat11(join31(dir, e.name, ".git")).then(() => true, () => false)) out.push(join31(dir, e.name));
+    if (await stat11(join32(dir, e.name, ".git")).then(() => true, () => false)) out.push(join32(dir, e.name));
   }
   return out.sort();
 }
 function commonDir(paths) {
-  const split = paths.map((p) => dirname18(p).split(sep2));
+  const split = paths.map((p) => dirname19(p).split(sep2));
   const common2 = [];
   for (let i2 = 0; split.every((s) => s[i2] !== void 0 && s[i2] === split[0][i2]); i2++) common2.push(split[0][i2]);
   return common2.join(sep2) || sep2;
@@ -28001,7 +29068,7 @@ function buildRunSheet(opts) {
       `- Clone: \`${r.root}\``,
       `- Launch: \`${launch(r)}\``,
       `- Resume: \`${launch(r)} --resume --message "<answer or correction>"\``,
-      `- Session file: \`${join31(r.root, SCAN_SESSION_FILE)}\``
+      `- Session file: \`${join32(r.root, SCAN_SESSION_FILE)}\``
     ])
   ];
   if (opts.context.length > 0) {
@@ -28050,7 +29117,7 @@ async function runAddRepos(opts, deps = {}) {
       roots.push(found.root);
       continue;
     }
-    const dest = join31(cwd, arg.split("/")[1]);
+    const dest = join32(cwd, arg.split("/")[1]);
     if (await (deps.isDirectory ?? isDirectory)(dest)) return fail2(78, `${dest} exists and is not a clone of ${arg} \u2014 move it, or pass the clone's path`);
     log(`cloning ${arg} into ${dest}`);
     const cloned = await (deps.cloneRepo ?? cloneFromGitHub)(arg, dest);
@@ -28422,8 +29489,8 @@ var init_dispatch7 = __esm({
 });
 
 // src/doctor/collect.ts
-import { readFile as readFile17 } from "node:fs/promises";
-import { join as join32 } from "node:path";
+import { readFile as readFile18 } from "node:fs/promises";
+import { join as join33 } from "node:path";
 function binaryPresent(name) {
   try {
     requireBinary(name);
@@ -28439,7 +29506,7 @@ async function git3(cwd, args) {
 async function readMcpPin(repoRoot) {
   const empty = { installed: false, pin: { project: null, branch: null } };
   try {
-    const raw = await readFile17(join32(repoRoot, ".mcp.json"), "utf8");
+    const raw = await readFile18(join33(repoRoot, ".mcp.json"), "utf8");
     const parsed = JSON.parse(raw);
     const servers = parsed.mcpServers ?? {};
     const entry = Object.entries(servers).find(([name]) => /archme/i.test(name));
@@ -28813,9 +29880,9 @@ __export(dispatch_exports8, {
   parseDoctorArgs: () => parseDoctorArgs,
   printDoctorHelp: () => printDoctorHelp
 });
-import { mkdtemp as mkdtemp6, rm as rm11, writeFile as writeFile17 } from "node:fs/promises";
-import { tmpdir as tmpdir6 } from "node:os";
-import { join as join33 } from "node:path";
+import { mkdtemp as mkdtemp7, rm as rm11, writeFile as writeFile18 } from "node:fs/promises";
+import { tmpdir as tmpdir7 } from "node:os";
+import { join as join34 } from "node:path";
 function parseDoctorArgs(argv) {
   const args = { plain: false, help: false };
   for (const a2 of argv) {
@@ -28876,9 +29943,9 @@ async function dispatchDoctor(argv) {
     );
     return EX_OK6;
   }
-  const dir = await mkdtemp6(join33(tmpdir6(), "archme-doctor-"));
-  const mcpConfigPath = join33(dir, "mcp.json");
-  await writeFile17(mcpConfigPath, JSON.stringify({ mcpServers: {} }), { mode: 384 });
+  const dir = await mkdtemp7(join34(tmpdir7(), "archme-doctor-"));
+  const mcpConfigPath = join34(dir, "mcp.json");
+  await writeFile18(mcpConfigPath, JSON.stringify({ mcpServers: {} }), { mode: 384 });
   try {
     const result = await spawnClaude({
       prompt: buildDoctorPrompt(facts, issues),
@@ -29045,7 +30112,7 @@ var init_conciergeToken = __esm({
 });
 
 // src/daemon/sandboxJob/input.ts
-import { readFile as readFile18 } from "node:fs/promises";
+import { readFile as readFile19 } from "node:fs/promises";
 function isObj2(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -29154,6 +30221,31 @@ function parseRepoScope(raw) {
   }
   fail("repoScope must be { kind: all | container | excluding }");
 }
+function parseProbe(data) {
+  const timeoutMs = data.timeoutMs;
+  if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) fail("timeoutMs must be a positive integer");
+  if (!Array.isArray(data.targets) || data.targets.length > 64) fail("targets must be an array of at most 64");
+  const targets = data.targets.map((raw, i2) => {
+    const where = `targets[${i2}]`;
+    if (!isObj2(raw)) fail(`${where} must be an object`);
+    const id = str3(raw, "id", where);
+    if (!PROBE_ID_RE.test(id)) fail(`${where}.id must be [a-z0-9_]`);
+    const kind = raw.kind;
+    if (!PROBE_KINDS.has(kind)) fail(`${where}.kind is not a probe kind`);
+    const host = str3(raw, "host", where);
+    if (kind === "ipv6_socket" ? host !== "::" : !IPV4_RE2.test(host)) fail(`${where}.host must be an IPv4 address`);
+    const port = raw.port;
+    if (!Number.isInteger(port) || port < 0 || port > 65535) fail(`${where}.port is not a port`);
+    const target = { id, kind, host, port };
+    if (raw.authority !== void 0) {
+      const a2 = raw.authority;
+      if (kind !== "connect" || typeof a2 !== "string" || !/^[A-Za-z0-9.\-[\]:]{1,300}$/.test(a2)) fail(`${where}.authority is not host:port`);
+      target.authority = a2;
+    }
+    return target;
+  });
+  return { kind: "probe", targets, timeoutMs };
+}
 function parseInput(raw) {
   let data;
   try {
@@ -29162,6 +30254,7 @@ function parseInput(raw) {
     fail("not valid JSON");
   }
   if (!isObj2(data)) fail("must be a JSON object");
+  if (data.kind === "probe") return parseProbe(data);
   const job = parseJob(data.job);
   if (data.kind === "clone") {
     const input = {
@@ -29192,9 +30285,9 @@ function parseInput(raw) {
     };
     return input;
   }
-  fail("kind must be clone or agent");
+  fail("kind must be clone, agent or probe");
 }
-async function readInput(path7 = INPUT_PATH, read = (p) => readFile18(p, "utf8")) {
+async function readInput(path7 = INPUT_PATH, read = (p) => readFile19(p, "utf8")) {
   let raw;
   try {
     raw = await read(path7);
@@ -29203,7 +30296,7 @@ async function readInput(path7 = INPUT_PATH, read = (p) => readFile18(p, "utf8")
   }
   return parseInput(raw);
 }
-var InputSchemaError, SHA_RE3, REPO_PART_RE, IPV4_RE2, SOURCE_MODES;
+var InputSchemaError, SHA_RE3, REPO_PART_RE, IPV4_RE2, SOURCE_MODES, PROBE_KINDS, PROBE_ID_RE;
 var init_input = __esm({
   "src/daemon/sandboxJob/input.ts"() {
     "use strict";
@@ -29218,6 +30311,135 @@ var init_input = __esm({
     REPO_PART_RE = /^[A-Za-z0-9_.-]+$/;
     IPV4_RE2 = /^(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)$/;
     SOURCE_MODES = /* @__PURE__ */ new Set(["diff", "reconcile", "pr_update"]);
+    PROBE_KINDS = /* @__PURE__ */ new Set(["tcp", "udp_dns", "http", "connect", "ipv6_socket"]);
+    PROBE_ID_RE = /^[a-z0-9_]{1,64}$/;
+  }
+});
+
+// src/daemon/sandboxJob/probe.ts
+import dgram from "node:dgram";
+import http2 from "node:http";
+import net2 from "node:net";
+function tcp(t, timeoutMs) {
+  return new Promise((resolve7) => {
+    const s = net2.connect({ host: t.host, port: t.port });
+    const finish = (outcome) => {
+      s.destroy();
+      resolve7(outcome);
+    };
+    s.setTimeout(timeoutMs, () => finish("timeout"));
+    s.once("connect", () => finish("connected"));
+    s.once("error", (e) => {
+      finish(e.code === "ECONNREFUSED" ? "refused" : e.code === "ETIMEDOUT" ? "timeout" : "unreachable");
+    });
+  });
+}
+function udpDns(t, timeoutMs) {
+  return new Promise((resolve7) => {
+    const s = dgram.createSocket("udp4");
+    let done = false;
+    const finish = (outcome) => {
+      if (done) return;
+      done = true;
+      clearTimeout(timer);
+      s.close();
+      resolve7(outcome);
+    };
+    const timer = setTimeout(() => finish("silent"), timeoutMs);
+    s.on("message", () => finish("answered"));
+    s.on("error", () => finish("silent"));
+    s.send(DNS_QUERY, t.port, t.host, (err4) => {
+      if (err4) finish("silent");
+    });
+  });
+}
+function httpStatus(t, timeoutMs, method) {
+  return new Promise((resolve7) => {
+    let done = false;
+    const finish = (outcome) => {
+      if (done) return;
+      done = true;
+      req.destroy();
+      resolve7(outcome);
+    };
+    const req = http2.request({
+      host: t.host,
+      port: t.port,
+      method,
+      agent: false,
+      timeout: timeoutMs,
+      path: method === "CONNECT" ? t.authority ?? "github.com:443" : "/"
+    });
+    req.on("response", (res) => {
+      res.resume();
+      finish(String(res.statusCode ?? "none"));
+    });
+    req.on("connect", (res, socket) => {
+      socket.destroy();
+      finish(String(res.statusCode ?? "none"));
+    });
+    req.on("timeout", () => finish("none"));
+    req.on("error", () => finish("none"));
+    req.end();
+  });
+}
+function ipv6Socket() {
+  return new Promise((resolve7) => {
+    const s = dgram.createSocket("udp6");
+    s.once("error", () => {
+      s.close();
+      resolve7("unsupported");
+    });
+    s.bind(0, "::", () => {
+      s.close();
+      resolve7("created");
+    });
+  });
+}
+async function runProbe(input) {
+  const results = await Promise.all(input.targets.map(async (t) => {
+    switch (t.kind) {
+      case "tcp":
+        return [t.id, await tcp(t, input.timeoutMs)];
+      case "udp_dns":
+        return [t.id, await udpDns(t, input.timeoutMs)];
+      case "http":
+        return [t.id, await httpStatus(t, input.timeoutMs, "GET")];
+      case "connect":
+        return [t.id, await httpStatus(t, input.timeoutMs, "CONNECT")];
+      case "ipv6_socket":
+        return [t.id, await ipv6Socket()];
+    }
+  }));
+  return Object.fromEntries(results);
+}
+var DNS_QUERY;
+var init_probe = __esm({
+  "src/daemon/sandboxJob/probe.ts"() {
+    "use strict";
+    DNS_QUERY = Buffer.from([
+      18,
+      52,
+      1,
+      0,
+      0,
+      1,
+      0,
+      0,
+      0,
+      0,
+      0,
+      0,
+      7,
+      ...Buffer.from("example"),
+      3,
+      ...Buffer.from("com"),
+      0,
+      0,
+      1,
+      0,
+      1
+    ]);
   }
 });
 
@@ -29227,7 +30449,7 @@ __export(main_exports, {
   readNonceLine: () => readNonceLine,
   runSandboxJob: () => runSandboxJob
 });
-import { mkdir as mkdir16 } from "node:fs/promises";
+import { mkdir as mkdir17 } from "node:fs/promises";
 function readNonceLine(stream = process.stdin) {
   return new Promise((resolve7) => {
     let buf = "";
@@ -29252,6 +30474,10 @@ function readNonceLine(stream = process.stdin) {
   });
 }
 function emptyResult(step, error) {
+  if (step === "probe") {
+    const r2 = { kind: "probe", outcomes: {}, memoryPeakBytes: null, durations_ms: {}, error };
+    return r2;
+  }
   if (step === "clone") {
     const r2 = { kind: "clone", outcome: "diff", memoryPeakBytes: null, durations_ms: {}, error };
     return r2;
@@ -29299,8 +30525,8 @@ async function runSandboxJob(argv, deps = {}) {
     return code;
   };
   const step = argv[0];
-  if (step !== "clone" && step !== "agent") {
-    const msg = `unknown step ${JSON.stringify(step ?? "")}; expected clone or agent`;
+  if (step !== "clone" && step !== "agent" && step !== "probe") {
+    const msg = `unknown step ${JSON.stringify(step ?? "")}; expected clone, agent or probe`;
     log(msg);
     return emit2(emptyResult("clone", msg), EXIT_INPUT_SCHEMA);
   }
@@ -29314,9 +30540,19 @@ async function runSandboxJob(argv, deps = {}) {
     return emit2(emptyResult(step, msg), err4 instanceof InputSchemaError ? EXIT_INPUT_SCHEMA : 1);
   }
   mark("input");
+  if (input.kind === "probe") {
+    try {
+      const outcomes = await (deps.probe ?? runProbe)(input);
+      return emit2({ kind: "probe", outcomes, memoryPeakBytes: null, durations_ms: {} }, 0);
+    } catch (err4) {
+      const msg = err4 instanceof Error ? err4.message : String(err4);
+      log(`failed: ${msg}`);
+      return emit2(emptyResult("probe", msg), 1);
+    }
+  }
   log(`${step} job=${input.job.id} repo=${input.job.repo_owner}/${input.job.repo_name} after=${input.job.after_sha.slice(0, 8)}`);
   try {
-    await mkdir16(deps.homeDir ?? process.env.HOME ?? BOX_HOME, { recursive: true, mode: 448 });
+    await mkdir17(deps.homeDir ?? process.env.HOME ?? BOX_HOME, { recursive: true, mode: 448 });
     if (input.kind === "clone") {
       const { result: result2, exitCode: exitCode2 } = await runCloneStep(input, { log, mark, ...deps.clone });
       return emit2({ ...result2, memoryPeakBytes: null, durations_ms: {} }, exitCode2);
@@ -29338,6 +30574,7 @@ var init_main2 = __esm({
     init_result2();
     init_clone();
     init_agent();
+    init_probe();
     NONCE_LINE_MAX_BYTES = 256;
   }
 });
@@ -29416,7 +30653,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "doctor",
   // Hidden: operator-only (platform admins), deliberately absent from printHelp.
   "concierge-token",
-  // Hidden: the per-job sandbox image's entrypoint (`sandbox-job clone|agent`).
+  // Hidden: the per-job sandbox image's entrypoint (`sandbox-job clone|agent|probe`).
   "sandbox-job"
 ]);
 var VERSION_FLAGS = /* @__PURE__ */ new Set(["--version", "-v"]);
@@ -29439,7 +30676,8 @@ var DAEMON_SUBCOMMANDS = /* @__PURE__ */ new Set([
   "disable",
   "install",
   "uninstall",
-  "run"
+  "run",
+  "sandbox"
 ]);
 function routeDaemon(args) {
   const sub = args[0];
@@ -29473,6 +30711,11 @@ function routeDaemon(args) {
       return { action: "uninstall", purge: hasFlag("--purge") };
     case "run":
       return { action: "run" };
+    case "sandbox": {
+      if (rest[0] === "setup") return { action: "sandbox-setup", yes: rest.includes("--yes") || rest.includes("-y") };
+      if (rest[0] === "status") return { action: "sandbox-status" };
+      return { action: "unknown", arg: ["sandbox", ...rest.slice(0, 1)].join(" ") };
+    }
   }
   return { action: "unknown", arg: sub };
 }
@@ -29613,4 +30856,10 @@ Run 'archme init --help', 'archme daemon --help', 'archme analyze --help', or
 }
 
 // src/bin.ts
-main(process.argv.slice(2)).then((code) => process.exit(code));
+main(process.argv.slice(2)).then(
+  (code) => process.exit(code),
+  (err4) => {
+    console.error(err4 instanceof Error ? err4.message : String(err4));
+    process.exit(1);
+  }
+);