@cabane/companion 0.6.125 → 0.6.127

package/dist/cli.js

@@ -541,6 +541,10 @@ var init_config = __esm({
       // wraps the runner in an OS sandbox where the host supports one; `'none'`
       // (the default) runs it as a plain child beside this process, a supported
       // configuration in its own right rather than a degraded one.
+      // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
+      // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
+      // bad policy refuses the turns it governs, with the field named, instead of
+      // keeping the companion from starting at all.
       runners: z2.object({
         enabled: z2.boolean().optional(),
         provider: z2.enum(["local-process", "docker"]).optional(),
@@ -574,7 +578,8 @@ var init_config = __esm({
           // container's git for an allowed host, e.g. `!gh auth git-credential`.
           // Absent: git's own configured helpers on this device.
           gitCredentialHelper: z2.string().min(1).optional()
-        }).strict().optional()
+        }).strict().optional(),
+        policy: z2.unknown().optional()
       }).strict().optional()
     });
   }
@@ -6662,6 +6667,173 @@ var init_src = __esm({
   }
 });
 
+// src/runner/sandbox-policy.ts
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+import { globToRegex } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
+import { z as z13 } from "zod";
+function parseSandboxPolicy(raw) {
+  if (raw === void 0) return { ok: true, policy: {} };
+  const result = sandboxPolicySchema.safeParse(raw);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    return { ok: false, error: `${fieldPath(issue.path)}: ${issue.message}` };
+  }
+  const refused = unenforceable(result.data);
+  return refused ? { ok: false, error: refused } : { ok: true, policy: result.data };
+}
+function fieldPath(path) {
+  return ["runners", "policy", ...path.map(String)].join(".");
+}
+function unenforceable(policy) {
+  const hostLists = [
+    ["hosts.allow", "allowedDomains", policy.hosts?.allow],
+    ["hosts.deny", "deniedDomains", policy.hosts?.deny],
+    ...Object.entries(policy.credentials?.env ?? {}).map(
+      ([name, entry]) => [
+        `credentials.env.${name}.hosts`,
+        "allowedDomains",
+        entry.hosts
+      ]
+    )
+  ];
+  for (const [field, as, hosts] of hostLists) {
+    for (const [i, host] of (hosts ?? []).entries()) {
+      const check = NetworkConfigSchema.safeParse({
+        allowedDomains: as === "allowedDomains" ? [host] : [],
+        deniedDomains: as === "deniedDomains" ? [host] : []
+      });
+      if (!check.success) {
+        const message = check.error.issues[0]?.message ?? "not a host pattern the sandbox accepts";
+        return `runners.policy.${field}.${i}: ${message}`;
+      }
+    }
+  }
+  const pathLists = [
+    ["filesystem.denyRead", policy.filesystem?.denyRead],
+    ["filesystem.allowRead", policy.filesystem?.allowRead],
+    ["filesystem.allowWrite", policy.filesystem?.allowWrite]
+  ];
+  for (const [field, paths] of pathLists) {
+    for (const [i, path] of (paths ?? []).entries()) {
+      try {
+        new RegExp(globToRegex(path));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return `runners.policy.${field}.${i}: not a pattern the sandbox can match (${message})`;
+      }
+    }
+  }
+  return null;
+}
+function modelHostsFor(runtime) {
+  if (runtime === "claude-code") return ANTHROPIC_HOSTS;
+  if (runtime === "codex") return OPENAI_HOSTS;
+  return [...ANTHROPIC_HOSTS, ...OPENAI_HOSTS];
+}
+function gitAuthVar(index) {
+  return `CABANE_GIT_AUTH_${index}`;
+}
+function resolvePolicyCredentials(policy, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const credentials = [];
+  const lookup2 = (ref) => {
+    const name = placeholderName(ref);
+    const value = store.get(name);
+    if (value === void 0) missing.add(name);
+    return value;
+  };
+  for (const [name, entry] of Object.entries(policy.credentials?.env ?? {})) {
+    const value = lookup2(entry.secret);
+    if (value === void 0) continue;
+    credentials.push({ name, value, hosts: entry.hosts });
+  }
+  (policy.credentials?.git ?? []).forEach((entry, i) => {
+    const secret = lookup2(entry.secret);
+    if (secret === void 0) return;
+    const user = entry.username ?? "x-access-token";
+    credentials.push({
+      name: gitAuthVar(i),
+      value: Buffer.from(`${user}:${secret}`).toString("base64"),
+      hosts: [entry.host.replace(/:\d+$/, "")],
+      gitHost: entry.host
+    });
+  });
+  return { credentials, missing: [...missing].sort() };
+}
+function policyHasCredentials(policy) {
+  return Object.keys(policy.credentials?.env ?? {}).length > 0 || (policy.credentials?.git ?? []).length > 0;
+}
+function postureLines(parsed) {
+  if (!parsed.ok) return [`policy invalid \u2014 turns are refused until it's fixed: ${parsed.error}`];
+  const { policy } = parsed;
+  const mode = policy.filesystem?.mode ?? "blocklist";
+  const defaults = policy.hosts?.defaults !== false;
+  const lines2 = [
+    `filesystem: ${mode}${mode === "strict" ? " (home unreadable except the checkout, harness state and allowRead)" : ""}`,
+    `hosts: Cabane + the turn's model provider${defaults ? " + defaults (GitHub, npm, PyPI, crates.io)" : ""}${policy.hosts?.allow?.length ? ` + ${policy.hosts.allow.join(", ")}` : ""}`
+  ];
+  if (policy.hosts?.deny?.length) lines2.push(`hosts denied: ${policy.hosts.deny.join(", ")}`);
+  const extraDeny = policy.filesystem?.denyRead ?? [];
+  if (extraDeny.length) lines2.push(`denied reads (extra): ${extraDeny.join(", ")}`);
+  const allowRead = policy.filesystem?.allowRead ?? [];
+  if (allowRead.length) lines2.push(`reads allowed back: ${allowRead.join(", ")}`);
+  const allowWrite = policy.filesystem?.allowWrite ?? [];
+  if (allowWrite.length) lines2.push(`writes allowed (extra): ${allowWrite.join(", ")}`);
+  const env = Object.keys(policy.credentials?.env ?? {});
+  const git = (policy.credentials?.git ?? []).map((g) => `git@${g.host}`);
+  if (env.length || git.length) {
+    lines2.push(`masked credentials: ${[...env, ...git].join(", ")}`);
+  }
+  return lines2;
+}
+var hostPattern, secretRef, envCredentialSchema, gitCredentialSchema, sandboxPolicySchema, DEFAULT_ALLOWED_HOSTS, ANTHROPIC_HOSTS, OPENAI_HOSTS, placeholderName, HarnessSandboxRefused;
+var init_sandbox_policy = __esm({
+  "src/runner/sandbox-policy.ts"() {
+    "use strict";
+    hostPattern = z13.string().min(1);
+    secretRef = z13.string().regex(/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/, "must be a ${NAME} reference into secrets.json");
+    envCredentialSchema = z13.object({ secret: secretRef, hosts: z13.array(hostPattern).min(1) }).strict();
+    gitCredentialSchema = z13.object({
+      host: z13.string().regex(/^[A-Za-z0-9.-]+(:\d+)?$/, "must be a host name, like github.com"),
+      username: z13.string().min(1).optional(),
+      secret: secretRef
+    }).strict();
+    sandboxPolicySchema = z13.object({
+      hosts: z13.object({
+        allow: z13.array(hostPattern).optional(),
+        deny: z13.array(hostPattern).optional(),
+        defaults: z13.boolean().optional()
+      }).strict().optional(),
+      filesystem: z13.object({
+        mode: z13.enum(["blocklist", "strict"]).optional(),
+        denyRead: z13.array(z13.string().min(1)).optional(),
+        allowRead: z13.array(z13.string().min(1)).optional(),
+        allowWrite: z13.array(z13.string().min(1)).optional()
+      }).strict().optional(),
+      credentials: z13.object({
+        env: z13.record(z13.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), envCredentialSchema).optional(),
+        git: z13.array(gitCredentialSchema).optional()
+      }).strict().optional()
+    }).strict();
+    DEFAULT_ALLOWED_HOSTS = [
+      "github.com",
+      "*.github.com",
+      "*.githubusercontent.com",
+      "registry.npmjs.org",
+      "pypi.org",
+      "files.pythonhosted.org",
+      "crates.io",
+      "static.crates.io",
+      "index.crates.io"
+    ];
+    ANTHROPIC_HOSTS = ["api.anthropic.com", "*.anthropic.com", "claude.ai", "*.claude.ai"];
+    OPENAI_HOSTS = ["api.openai.com", "auth.openai.com", "chatgpt.com", "*.chatgpt.com"];
+    placeholderName = (ref) => ref.slice(2, -1);
+    HarnessSandboxRefused = class extends Error {
+    };
+  }
+});
+
 // src/runner/opencode-lock.ts
 function opencodeLockKey(serverUrl) {
   return `opencode:${serverUrl}`;
@@ -7023,7 +7195,7 @@ var init_turn_containment = __esm({
 // src/secrets.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 import { join as join10 } from "path";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 function secretsPath() {
   return join10(cabaneDir(), "secrets.json");
 }
@@ -7108,19 +7280,30 @@ function resolveMcpSecrets(mcpServers, store) {
   }
   return { servers, missing: [...missing].sort() };
 }
-var PLACEHOLDER_RE, secretStoreSchema;
+function missingSecretReason(missing) {
+  const prefix = "missing_secret: ";
+  for (let shown = missing.length; shown >= 0; shown--) {
+    const omitted = missing.length - shown;
+    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
+    const reason = prefix + parts.join(",");
+    if (reason.length <= ERROR_REASON_MAX) return reason;
+  }
+  return `${prefix}+${missing.length}`;
+}
+var PLACEHOLDER_RE, secretStoreSchema, ERROR_REASON_MAX;
 var init_secrets = __esm({
   "src/secrets.ts"() {
     "use strict";
     init_config();
     init_errors();
     PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
-    secretStoreSchema = z13.record(z13.string(), z13.string());
+    secretStoreSchema = z14.record(z14.string(), z14.string());
+    ERROR_REASON_MAX = 200;
   }
 });
 
 // src/run-config.ts
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 function parseRunConfig(raw, onWarn) {
   const result = runConfigSchema.safeParse(raw ?? {});
   if (result.success) return result.data;
@@ -7133,38 +7316,38 @@ var mcpStdioServerSchema, mcpHttpServerSchema, mcpSseServerSchema, mcpServerDefS
 var init_run_config = __esm({
   "src/run-config.ts"() {
     "use strict";
-    mcpStdioServerSchema = z14.object({
-      type: z14.literal("stdio").optional(),
-      command: z14.string().min(1),
-      args: z14.array(z14.string()).optional(),
-      env: z14.record(z14.string(), z14.string()).optional()
+    mcpStdioServerSchema = z15.object({
+      type: z15.literal("stdio").optional(),
+      command: z15.string().min(1),
+      args: z15.array(z15.string()).optional(),
+      env: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpHttpServerSchema = z14.object({
-      type: z14.literal("http"),
-      url: z14.string().url(),
-      headers: z14.record(z14.string(), z14.string()).optional()
+    mcpHttpServerSchema = z15.object({
+      type: z15.literal("http"),
+      url: z15.string().url(),
+      headers: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpSseServerSchema = z14.object({
-      type: z14.literal("sse"),
-      url: z14.string().url(),
-      headers: z14.record(z14.string(), z14.string()).optional()
+    mcpSseServerSchema = z15.object({
+      type: z15.literal("sse"),
+      url: z15.string().url(),
+      headers: z15.record(z15.string(), z15.string()).optional()
     });
-    mcpServerDefSchema = z14.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-    thinkingConfigSchema = z14.discriminatedUnion("type", [
-      z14.object({ type: z14.literal("adaptive") }),
-      z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
-      z14.object({ type: z14.literal("disabled") })
+    mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+    thinkingConfigSchema = z15.discriminatedUnion("type", [
+      z15.object({ type: z15.literal("adaptive") }),
+      z15.object({ type: z15.literal("enabled"), budgetTokens: z15.number().int().positive().optional() }),
+      z15.object({ type: z15.literal("disabled") })
     ]);
-    effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
-    runConfigSchema = z14.object({
+    effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
+    runConfigSchema = z15.object({
       // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
       // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
       // is the locked surface. Kept in lockstep with `@cabane/shared`'s
       // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
       // stripped, so an older companion riding a newer server never rejects the config).
-      hostAccess: z14.boolean().optional(),
-      mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
-      model: z14.string().min(1).optional(),
+      hostAccess: z15.boolean().optional(),
+      mcpServers: z15.record(z15.string(), mcpServerDefSchema).optional(),
+      model: z15.string().min(1).optional(),
       thinking: thinkingConfigSchema.optional(),
       effort: effortSchema.optional()
     });
@@ -7173,7 +7356,7 @@ var init_run_config = __esm({
 });
 
 // src/runner/protocol.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 function required(env, name) {
   const value = env[name];
   if (!value) throw new Error(`runner: ${name} is not set`);
@@ -7186,6 +7369,7 @@ function parseRunnerInput(env, stdin) {
   return {
     baseUrl: required(env, RUNNER_ENV.url),
     credential: credentials.credential,
+    sandboxCredentials: credentials.sandboxCredentials ?? [],
     dispatch,
     turnId: required(env, RUNNER_ENV.turnId),
     resumed: env[RUNNER_ENV.resumed] === "1",
@@ -7202,7 +7386,10 @@ function runnerEnv(input) {
   };
 }
 function runnerStdin(input) {
-  return `${JSON.stringify({ credential: input.credential })}
+  return `${JSON.stringify({
+    credential: input.credential,
+    ...input.sandboxCredentials?.length ? { sandboxCredentials: input.sandboxCredentials } : {}
+  })}
 `;
 }
 function encodeLauncherMessage(message) {
@@ -7238,6 +7425,7 @@ var init_protocol = __esm({
     "use strict";
     init_config();
     init_run_config();
+    init_sandbox_policy();
     RUNNER_ENV = {
       // The wire the runner speaks.
       url: "CABANE_URL",
@@ -7251,64 +7439,75 @@ var init_protocol = __esm({
       // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
       spec: "CABANE_RUNNER_SPEC"
     };
-    runtimeHealthSchema = z15.object({
-      quotaState: z15.enum(["ok", "limited", "auth_expired", "unknown"]),
-      limitedUntil: z15.string().nullable(),
-      lastError: z15.string().nullable()
+    runtimeHealthSchema = z16.object({
+      quotaState: z16.enum(["ok", "limited", "auth_expired", "unknown"]),
+      limitedUntil: z16.string().nullable(),
+      lastError: z16.string().nullable()
     });
-    runnerSpecSchema = z15.object({
-      deviceId: z15.string().optional(),
+    runnerSpecSchema = z16.object({
+      deviceId: z16.string().optional(),
       // The launcher's boot id: the one its heartbeat carries, so a runner's lease
       // matches the device that holds it.
-      bootId: z15.string(),
-      workspaceId: z15.string(),
-      workspaceSlug: z15.string(),
-      agentId: z15.string(),
-      agentUsername: z15.string(),
-      agentName: z15.string(),
+      bootId: z16.string(),
+      workspaceId: z16.string(),
+      workspaceSlug: z16.string(),
+      agentId: z16.string(),
+      agentUsername: z16.string(),
+      agentName: z16.string(),
       local: localAgentConfigSchema,
       runConfig: runConfigSchema,
-      opencodeServerUrl: z15.string().optional(),
-      claudeCodeAvailable: z15.boolean(),
-      codexAvailable: z15.boolean(),
-      idleTimeoutMs: z15.number().int().positive().optional(),
-      totalTimeoutMs: z15.number().int().positive().optional(),
-      leaseRenewalMs: z15.number().int().positive().optional(),
-      preparingRowDelayMs: z15.number().int().nonnegative().optional(),
+      opencodeServerUrl: z16.string().optional(),
+      claudeCodeAvailable: z16.boolean(),
+      codexAvailable: z16.boolean(),
+      idleTimeoutMs: z16.number().int().positive().optional(),
+      totalTimeoutMs: z16.number().int().positive().optional(),
+      leaseRenewalMs: z16.number().int().positive().optional(),
+      preparingRowDelayMs: z16.number().int().nonnegative().optional(),
       // Whether the turn writes a transcript. The directory is the runner's own
       // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
-      transcripts: z15.boolean(),
+      transcripts: z16.boolean(),
       // Whether the harness starts under the OS sandbox. The launcher sends 'os'
       // only when this host can make one.
-      sandbox: z15.enum(["os", "none"]),
-      logLevel: z15.string(),
+      sandbox: z16.enum(["os", "none"]),
+      // CT1684: the device's sandbox policy, validated by the launcher. Absent
+      // when the sandbox is off.
+      sandboxPolicy: sandboxPolicySchema.optional(),
+      logLevel: z16.string(),
       // The launcher's connector-health observations, by runtime, as of the start.
-      connectorHealth: z15.record(z15.string(), runtimeHealthSchema),
+      connectorHealth: z16.record(z16.string(), runtimeHealthSchema),
       // True when this (conversation, agent) pair was already told its session
       // could not be saved: the notice is once per pair, not once per process.
-      sessionWriteNoticeClaimed: z15.boolean(),
+      sessionWriteNoticeClaimed: z16.boolean(),
       // CT1680: the runner's identity, minted with its credential. The start
       // PATCH carries it so the lease knows which runner holds the span.
-      runnerId: z15.string(),
+      runnerId: z16.string(),
       // CT1681: the launcher keeps the runtime's session files beside the attempt
       // and restores them into this runner's home, so the runner names the attempt
       // each context was composed for and waits for the launcher to say it's in
       // place. Absent: nothing to wait for (a runner on the launcher's own disk).
-      attemptState: z15.boolean().optional(),
+      attemptState: z16.boolean().optional(),
       // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
       // this machine's secrets.json. Absent: the runner reads the device's file.
-      secretsFromLauncher: z15.boolean().optional()
+      secretsFromLauncher: z16.boolean().optional()
     });
-    dispatchSchema = z15.object({
-      type: z15.literal("device:dispatch_requested"),
-      agentId: z15.string(),
-      deviceId: z15.string(),
-      conversationId: z15.string(),
-      messageId: z15.string(),
-      episode: z15.number().int().optional()
+    dispatchSchema = z16.object({
+      type: z16.literal("device:dispatch_requested"),
+      agentId: z16.string(),
+      deviceId: z16.string(),
+      conversationId: z16.string(),
+      messageId: z16.string(),
+      episode: z16.number().int().optional()
     });
-    credentialsSchema = z15.object({
-      credential: z15.string().startsWith("cabrn_")
+    credentialsSchema = z16.object({
+      credential: z16.string().startsWith("cabrn_"),
+      sandboxCredentials: z16.array(
+        z16.object({
+          name: z16.string(),
+          value: z16.string(),
+          hosts: z16.array(z16.string()),
+          gitHost: z16.string().optional()
+        })
+      ).optional()
     });
   }
 });
@@ -7360,6 +7559,7 @@ function runnerSpec(opts, launch, duties, runnerId) {
     sandbox: launch.sandbox ?? "none",
     ...launch.provider.bindAttempt ? { attemptState: true } : {},
     ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
+    ...launch.sandbox === "os" && launch.policy?.ok ? { sandboxPolicy: launch.policy.policy } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -7458,6 +7658,32 @@ async function settleUnstarted(opts, payload, turnId, errorReason, log) {
     );
   }
 }
+function sandboxInputs(launch, log) {
+  const policy = launch.policy ?? { ok: true, policy: {} };
+  if (launch.sandbox !== "os") {
+    if (policy.ok && policyHasCredentials(policy.policy)) {
+      log.debug(
+        "runners: runners.policy names credentials, but turns here run without the OS sandbox; none are given to the harness"
+      );
+    }
+    return { ok: true, credentials: [] };
+  }
+  if (!policy.ok) {
+    log.warn({ error: policy.error }, "runners: the sandbox policy is invalid; refusing the turn");
+    return { ok: false, reason: `setup_failed: ${policy.error}`.slice(0, 200) };
+  }
+  if (!policyHasCredentials(policy.policy)) return { ok: true, credentials: [] };
+  const store = (launch.secretStore ?? defaultSecretStore)(log);
+  const { credentials, missing } = resolvePolicyCredentials(policy.policy, store);
+  if (missing.length) {
+    log.debug(
+      { missing },
+      "runners: the sandbox policy names secrets this device does not declare"
+    );
+    return { ok: false, reason: missingSecretReason(missing) };
+  }
+  return { ok: true, credentials };
+}
 async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const startedAt = Date.now();
   const { turnId } = handleOpts;
@@ -7481,7 +7707,8 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     agentId: payload.agentId,
     turnId
   };
-  const minted = await mintForRunner(opts, payload, handleOpts, controller.signal, log);
+  const sandboxed = sandboxInputs(launch, log);
+  const minted = sandboxed.ok ? await mintForRunner(opts, payload, handleOpts, controller.signal, log) : { ok: false, reason: sandboxed.reason, errorReason: sandboxed.reason };
   if (!minted.ok) {
     controller.signal.removeEventListener("abort", forwardStop);
     duties.releaseAbort(turnId, controller);
@@ -7534,6 +7761,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     const input = {
       baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
+      sandboxCredentials: sandboxed.ok ? sandboxed.credentials : [],
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
@@ -7705,6 +7933,7 @@ var PINO_LEVELS;
 var init_launch = __esm({
   "src/runner/launch.ts"() {
     "use strict";
+    init_sandbox_policy();
     init_opencode_lock();
     init_api_error_shape();
     init_errors();
@@ -7725,7 +7954,7 @@ var init_launch = __esm({
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 function createSkipState() {
   return { skipped: false, reason: null };
 }
@@ -7776,7 +8005,7 @@ function createTurnControlMcpServer(acts, skipState) {
           SKIP_TURN_TOOL,
           TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
           {
-            reason: z16.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+            reason: z17.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
           },
           async (args) => {
             skipState.skipped = true;
@@ -7792,42 +8021,42 @@ function createTurnControlMcpServer(acts, skipState) {
         ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
         {
-          targetUserId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z16.array(
-            z16.union([
-              z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z16.object({
-                label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z16.object({
-                  task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+          targetUserId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z17.array(
+            z17.union([
+              z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z17.object({
+                label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z17.object({
+                  task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
                 }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
               })
             ])
           ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z16.array(
-            z16.object({
-              headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z16.array(
-                z16.union([
-                  z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z16.object({
-                    label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z16.object({
-                      task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+          questions: z17.array(
+            z17.object({
+              headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z17.array(
+                z17.union([
+                  z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z17.object({
+                    label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z17.object({
+                      task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
                     }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
                   })
                 ])
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z16.object({
-            askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z17.object({
+            askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -7868,9 +8097,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z16.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z16.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z16.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z17.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z17.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z17.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -7904,8 +8133,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -8498,16 +8727,6 @@ var init_turn_runtime_integrity = __esm({
 // src/turn-execution.ts
 import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 import { existsSync as existsSync9 } from "fs";
-function missingSecretReason(missing) {
-  const prefix = "missing_secret: ";
-  for (let shown = missing.length; shown >= 0; shown--) {
-    const omitted = missing.length - shown;
-    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
-    const reason = prefix + parts.join(",");
-    if (reason.length <= ERROR_REASON_MAX) return reason;
-  }
-  return `${prefix}+${missing.length}`;
-}
 function resolveIdleTimeoutMs(override) {
   return override ?? DEFAULT_AGENT_IDLE_TIMEOUT_MS;
 }
@@ -8544,7 +8763,7 @@ function fingerprintSessionState(state) {
   }
   return createHash2("sha256").update(opaqueId).digest("hex").slice(0, 16);
 }
-var PREPARING_TOOL_NAME, ERROR_REASON_MAX, RUNTIME_UNAVAILABLE_PREFIX, NO_TURN_TOKEN_REASON, UNEXPECTED_ROLE_REASON, DEFAULT_PREPARING_ROW_DELAY_MS, DEFAULT_AGENT_IDLE_TIMEOUT_MS, DEFAULT_AGENT_TOTAL_TIMEOUT_MS, DEFAULT_LEASE_RENEWAL_MS, TurnConcluded, TurnExecution;
+var PREPARING_TOOL_NAME, RUNTIME_UNAVAILABLE_PREFIX, NO_TURN_TOKEN_REASON, UNEXPECTED_ROLE_REASON, DEFAULT_PREPARING_ROW_DELAY_MS, DEFAULT_AGENT_IDLE_TIMEOUT_MS, DEFAULT_AGENT_TOTAL_TIMEOUT_MS, DEFAULT_LEASE_RENEWAL_MS, TurnConcluded, TurnExecution;
 var init_turn_execution = __esm({
   "src/turn-execution.ts"() {
     "use strict";
@@ -8568,8 +8787,8 @@ var init_turn_execution = __esm({
     init_turn_committer();
     init_turn_runtime_integrity();
     init_dispatcher();
+    init_sandbox_policy();
     PREPARING_TOOL_NAME = "preparing";
-    ERROR_REASON_MAX = 200;
     RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
     NO_TURN_TOKEN_REASON = "no_turn_token: the server issued no turn credential for this turn";
     UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
@@ -9133,7 +9352,18 @@ var init_turn_execution = __esm({
         const { payload, workspaceId, turnId, turnLog } = this;
         await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
         const onWarn = (msg, meta) => turnLog.debug(meta ?? {}, msg);
-        const sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({ cwd: this.effectiveCwd, log: turnLog }) : null;
+        let sandbox = null;
+        try {
+          sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({
+            cwd: this.effectiveCwd,
+            runtime: this.turnContext.runtime,
+            log: turnLog
+          }) : null;
+        } catch (err) {
+          if (!(err instanceof HarnessSandboxRefused)) throw err;
+          const reason = `setup_failed: ${err.message}`.slice(0, 200);
+          throw this.concluded(reason, reason);
+        }
         const adapters = [];
         if (this.opts.claudeCodeAvailable?.() ?? true) {
           this.containment = createTurnContainment(this.turnId, {
@@ -10009,10 +10239,20 @@ var init_git_credential = __esm({
 
 // src/runner/harness-sandbox.ts
 import { lookup } from "dns/promises";
-import { chmodSync as chmodSync6, mkdirSync as mkdirSync11, mkdtempSync, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import {
+  chmodSync as chmodSync6,
+  mkdirSync as mkdirSync11,
+  mkdtempSync,
+  readFileSync as readFileSync10,
+  realpathSync as realpathSync3,
+  rmSync as rmSync10,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
 import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
-import { join as join18 } from "path";
+import { dirname as dirname8, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function accountHome() {
   try {
@@ -10042,32 +10282,117 @@ async function resolvedAddresses(baseUrl) {
     return [];
   }
 }
+function companionPackageRoot(modulePath) {
+  for (let dir2 = dirname8(modulePath); ; dir2 = dirname8(dir2)) {
+    try {
+      const manifest = JSON.parse(readFileSync10(join18(dir2, "package.json"), "utf8"));
+      if (manifest.name === "@cabane/companion") return dir2;
+    } catch {
+    }
+    if (dirname8(dir2) === dir2) return null;
+  }
+}
+function harnessRuntimePaths() {
+  const paths = [dirname8(dirname8(process.execPath))];
+  const root = companionPackageRoot(fileURLToPath4(import.meta.url));
+  if (root) paths.push(root);
+  try {
+    const require2 = createRequire2(import.meta.url);
+    paths.push(
+      dirname8(realpathSync3(require2.resolve("@anthropic-ai/sandbox-runtime/package.json")))
+    );
+  } catch {
+  }
+  for (const runtime of ["claude-code", "codex"]) {
+    const bundled = resolveBundledBinary(runtime).path;
+    if (bundled) {
+      try {
+        paths.push(dirname8(realpathSync3(bundled)));
+      } catch {
+      }
+    }
+  }
+  return [...new Set(paths)];
+}
 function ownAddresses() {
   return Object.values(networkInterfaces()).flat().flatMap((i) => i ? [i.address] : []);
 }
+function expandHome(path, home) {
+  if (path === "~") return home;
+  return path.startsWith("~/") ? join18(home, path.slice(2)) : path;
+}
+function stripPort(pattern) {
+  return pattern.startsWith("[") ? pattern.replace(/^\[([^\]]+)\](:\d+)?$/, "$1") : pattern.replace(/:\d+$/, "");
+}
+function hostMatches(host, pattern) {
+  return pattern.startsWith("*.") ? host.endsWith(pattern.slice(1)) : host === pattern;
+}
+function patternsOverlap(a, b) {
+  if (a === b) return true;
+  const bare = (p) => p.startsWith("*.") ? p.slice(1) : p;
+  if (a.startsWith("*.") && b.startsWith("*.")) {
+    return bare(a).endsWith(bare(b)) || bare(b).endsWith(bare(a));
+  }
+  return hostMatches(a, b) || hostMatches(b, a);
+}
 function harnessSandboxConfig(input) {
+  const { policy } = input;
   const claudeDir = input.claudeConfigDir ?? join18(input.home, ".claude");
   const codexDir = input.codexHome ?? join18(input.home, ".codex");
+  const homes = [.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])];
+  const expand = (paths) => (paths ?? []).map((p) => expandHome(p, input.home));
+  const cabane = cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses);
+  const models = modelHostsFor(input.runtime);
+  const reachable = [
+    ...policy.hosts?.defaults === false ? [] : DEFAULT_ALLOWED_HOSTS,
+    ...policy.hosts?.allow ?? []
+  ];
+  const allowedDomains = [.../* @__PURE__ */ new Set([...cabane, ...models, ...reachable])];
+  const envGlobs = input.cwd ? [join18(input.cwd, "**/.env"), join18(input.cwd, "**/.env.*")] : [];
+  const secrets = [
+    input.cabaneDir,
+    ...homes.flatMap((home) => SECRET_PATHS_UNDER_HOME.map((p) => join18(home, p))),
+    ...envGlobs,
+    ...expand(policy.filesystem?.denyRead)
+  ];
+  const strict = policy.filesystem?.mode === "strict";
+  const denyRead = strict ? [...homes, ...secrets] : secrets;
+  const allowRead = strict ? [
+    ...input.cwd ? [input.cwd] : [],
+    claudeDir,
+    join18(input.home, ".claude.json"),
+    codexDir,
+    ...input.runtimePaths ?? [],
+    ...expand(policy.filesystem?.allowRead)
+  ] : expand(policy.filesystem?.allowRead);
+  const masked = input.credentials.map((c) => ({
+    name: c.name,
+    mode: "mask",
+    injectHosts: [...new Set(c.hosts.map(stripPort))]
+  }));
+  const injectAt = masked.flatMap((c) => c.injectHosts);
   return {
     network: {
-      allowedDomains: [
-        ...cabaneHostEntries(input.baseUrl, input.resolved, input.ownAddresses),
-        ...MODEL_AND_GIT_HOSTS
-      ],
-      deniedDomains: [],
-      allowLocalBinding: true
+      allowedDomains,
+      deniedDomains: policy.hosts?.deny ?? [],
+      allowLocalBinding: true,
+      // A masked credential is swapped in by a proxy that reads the request,
+      // so TLS is terminated — but only for the hosts a credential goes to.
+      // Cabane, the model provider and every other host keep their own
+      // end-to-end TLS through an opaque tunnel.
+      ...masked.length ? {
+        tlsTerminate: {
+          excludeDomains: [
+            ...new Set(
+              allowedDomains.map(stripPort).filter((host) => !injectAt.some((p) => patternsOverlap(host, p)))
+            )
+          ]
+        }
+      } : {}
     },
     filesystem: {
-      // The device's own state (its token, the agents' PATs, the secret store)
-      // and the account's keys, under whichever homes this process has.
-      denyRead: [
-        input.cabaneDir,
-        ...[.../* @__PURE__ */ new Set([input.home, input.accountHome ?? input.home])].flatMap((home) => [
-          join18(home, ".ssh"),
-          join18(home, ".aws"),
-          join18(home, ".gnupg")
-        ])
-      ],
+      denyRead,
+      ...allowRead.length ? { allowRead } : {},
       // The checkout, scratch, and the harnesses' own session state — a turn
       // resumes from `~/.claude` and `~/.codex`, and without write there every
       // resume starts from nothing.
@@ -10076,12 +10401,27 @@ function harnessSandboxConfig(input) {
         input.tmp,
         claudeDir,
         join18(input.home, ".claude.json"),
-        codexDir
+        codexDir,
+        ...expand(policy.filesystem?.allowWrite)
       ],
       denyWrite: []
-    }
+    },
+    ...masked.length ? { credentials: { envVars: masked } } : {}
   };
 }
+function gitCredentialExports(credentials) {
+  const git = credentials.filter((c) => c.gitHost);
+  if (!git.length) return "";
+  const lines2 = ["n=${GIT_CONFIG_COUNT:-0}"];
+  for (const c of git) {
+    lines2.push(
+      `export "GIT_CONFIG_KEY_$n=http.https://${c.gitHost}/.extraHeader" "GIT_CONFIG_VALUE_$n=Authorization: Basic $${c.name}"`,
+      "n=$((n+1))"
+    );
+  }
+  lines2.push("export GIT_CONFIG_COUNT=$n");
+  return lines2.join("; ") + "; ";
+}
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
     log.warn(
@@ -10102,7 +10442,9 @@ function osSandboxUsable(log) {
 }
 async function prepareHarnessSandbox(input) {
   let wrapped;
+  const held = input.credentials.map((c) => c.name);
   try {
+    for (const c of input.credentials) process.env[c.name] = c.value;
     const config = harnessSandboxConfig({
       cwd: input.cwd,
       baseUrl: input.baseUrl,
@@ -10113,28 +10455,50 @@ async function prepareHarnessSandbox(input) {
       tmp: tmpdir3(),
       cabaneDir: cabaneDir(),
       claudeConfigDir: process.env.CLAUDE_CONFIG_DIR,
-      codexHome: process.env.CODEX_HOME
+      codexHome: process.env.CODEX_HOME,
+      runtime: input.runtime,
+      policy: input.policy,
+      credentials: input.credentials,
+      runtimePaths: harnessRuntimePaths()
     });
     await SandboxManager.initialize(config);
+    if (input.policy.filesystem?.mode === "strict") {
+      input.log.info(
+        { readable: config.filesystem.allowRead },
+        "runners: strict sandbox \u2014 the home is unreadable except these paths; a path missing inside a turn and not listed here is hidden by the policy (add it to runners.policy.filesystem.allowRead)"
+      );
+    }
     input.log.debug(
       {
         allowWrite: config.filesystem.allowWrite,
         denyRead: config.filesystem.denyRead,
-        hosts: config.network.allowedDomains.length
+        allowRead: config.filesystem.allowRead,
+        hosts: config.network.allowedDomains,
+        masked: held
       },
       "runners: harness sandbox ready"
     );
     wrapped = await SandboxManager.wrapWithSandbox(
-      'export NO_PROXY= no_proxy=; eval "exec $CABANE_SANDBOXED_ARGV"'
+      "export NO_PROXY= no_proxy=; " + gitCredentialExports(input.credentials) + 'eval "exec $CABANE_SANDBOXED_ARGV"'
     );
   } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    await SandboxManager.reset().catch(() => {
+    });
+    if (held.length || Object.keys(input.policy).length) {
+      input.log.warn(
+        { err: message, masked: held },
+        "runners: the OS sandbox could not start under this device's runners.policy; refusing the turn rather than running it unsandboxed"
+      );
+      throw new HarnessSandboxRefused(`the OS sandbox could not start: ${message}`);
+    }
     input.log.warn(
-      { err: err instanceof Error ? err.message : String(err) },
+      { err: message },
       "runners: the OS sandbox could not start; running the turn unsandboxed"
     );
-    await SandboxManager.reset().catch(() => {
-    });
     return null;
+  } finally {
+    for (const name of held) delete process.env[name];
   }
   mkdirSync11(join18(cabaneDir(), "sandbox"), { recursive: true });
   const dir2 = mkdtempSync(join18(cabaneDir(), "sandbox", "turn-"));
@@ -10167,23 +10531,28 @@ exec ${shellQuote(script)} ${shellQuote(real)} "$@"
     }
   };
 }
-var MODEL_AND_GIT_HOSTS;
+var SECRET_PATHS_UNDER_HOME;
 var init_harness_sandbox = __esm({
   "src/runner/harness-sandbox.ts"() {
     "use strict";
+    init_bundled_binaries();
     init_config();
-    MODEL_AND_GIT_HOSTS = [
-      "api.anthropic.com",
-      "*.anthropic.com",
-      "claude.ai",
-      "*.claude.ai",
-      "api.openai.com",
-      "auth.openai.com",
-      "chatgpt.com",
-      "*.chatgpt.com",
-      "github.com",
-      "*.github.com",
-      "*.githubusercontent.com"
+    init_sandbox_policy();
+    SECRET_PATHS_UNDER_HOME = [
+      ".ssh",
+      ".aws",
+      ".gnupg",
+      ".config/gh",
+      ".git-credentials",
+      ".netrc",
+      ".npmrc",
+      ".pypirc",
+      ".docker/config.json",
+      ".kube",
+      ".config/gcloud",
+      ".azure",
+      ".config/op",
+      ".password-store"
     ];
   }
 });
@@ -10193,7 +10562,7 @@ import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync6,
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
@@ -10263,7 +10632,7 @@ var init_outbox = __esm({
           if (!name.endsWith(".json")) continue;
           const full = join19(dir2, name);
           try {
-            const parsed = JSON.parse(readFileSync10(full, "utf8"));
+            const parsed = JSON.parse(readFileSync11(full, "utf8"));
             if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
               entries.push(parsed);
             } else {
@@ -10367,12 +10736,12 @@ var init_outbox = __esm({
 });
 
 // src/version.ts
-import { createRequire as createRequire2 } from "module";
+import { createRequire as createRequire3 } from "module";
 var pkg, COMPANION_VERSION;
 var init_version2 = __esm({
   "src/version.ts"() {
     "use strict";
-    pkg = createRequire2(import.meta.url)("../package.json");
+    pkg = createRequire3(import.meta.url)("../package.json");
     COMPANION_VERSION = pkg.version;
   }
 });
@@ -10609,10 +10978,13 @@ function runnerDispatcherOptions(input, log, emit, extras = {}) {
       }
     },
     ...spec.sandbox === "os" ? {
-      harnessSandbox: async ({ cwd, log: turnLog }) => {
+      harnessSandbox: async ({ cwd, runtime, log: turnLog }) => {
         const sandbox = await prepareHarnessSandbox({
           cwd,
           baseUrl: input.baseUrl,
+          runtime,
+          policy: spec.sandboxPolicy ?? {},
+          credentials: input.sandboxCredentials ?? [],
           log: turnLog
         });
         if (sandbox) onSandbox?.(sandbox);
@@ -11886,7 +12258,7 @@ async function pair(opts = {}) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync13 } from "fs";
+import { readFileSync as readFileSync14 } from "fs";
 
 // src/commands/logs.ts
 import { once } from "events";
@@ -13438,6 +13810,15 @@ var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function containerName(attempt) {
   return `cabane-runner-${attempt.conversationId}-${attempt.agentId}`;
 }
+var networkName = containerName;
+function networkCreateError(stderr) {
+  const said = stderr.trim();
+  if (/address pool|fully subnetted/i.test(said))
+    return new Error(
+      `docker: couldn't create this conversation's runner network: the engine has no address pool left for another network. Each conversation and agent with a runner container holds one; remove kept runner containers, or widen \`default-address-pools\` in the daemon.json. Docker said: ${said}`
+    );
+  return new Error(`docker: creating the runner network failed: ${said || "no reason given"}`);
+}
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
   return join17(deviceDir, "attempts", attemptId, "session.tar");
@@ -13514,7 +13895,7 @@ function createDockerProvider(opts) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS2;
   const sessionCap = opts.sessionCapBytes ?? DEFAULT_SESSION_CAP_BYTES;
   const collectCap = opts.collectCapBytes ?? COLLECT_CAP_BYTES;
-  const network = `cabane-runners-${opts.deviceKey}`;
+  const sharedNetwork = `cabane-runners-${opts.deviceKey}`;
   const companionLabel = createHash4("sha256").update(opts.companion.key).digest("hex").slice(0, 16);
   const proxy = `cabane-egress-${opts.deviceKey}`;
   const held = /* @__PURE__ */ new Map();
@@ -13547,32 +13928,14 @@ function createDockerProvider(opts) {
     }
     throw new Error("docker: the egress proxy never started listening");
   };
-  let networkReady = null;
+  let proxyReady = null;
   const proxyKey = async () => {
     const id = (await docker.run(["image", "inspect", "-f", "{{.Id}}", opts.image])).stdout.trim();
     return createHash4("sha256").update(JSON.stringify([id || opts.image, opts.companion.key, [...opts.egressAllow].sort()])).digest("hex").slice(0, 16);
   };
-  const ensureNetwork = () => {
-    networkReady ??= (async () => {
+  const ensureProxy = () => {
+    proxyReady ??= (async () => {
       const allowKey = await proxyKey();
-      if ((await docker.run(["network", "inspect", network])).code !== 0) {
-        await must(
-          [
-            "network",
-            "create",
-            // No route off the host, and no address of the host's on the
-            // bridge: the host's own ports are out of reach too. The proxy is
-            // the only other thing on the network.
-            "--internal",
-            "-o",
-            "com.docker.network.bridge.inhibit_ipv4=true",
-            "--label",
-            `cabane.device=${opts.deviceKey}`,
-            network
-          ],
-          "creating the runners network"
-        );
-      }
       const seen = await docker.run([
         "inspect",
         "-f",
@@ -13581,6 +13944,7 @@ function createDockerProvider(opts) {
       ]);
       const [key, running] = seen.stdout.trim().split(" ");
       if (seen.code === 0 && key === allowKey) {
+        await retireSharedNetwork();
         if (running !== "true") {
           await must(["start", proxy], "starting the egress proxy");
           await proxyListening();
@@ -13615,17 +13979,61 @@ function createDockerProvider(opts) {
         ],
         "starting the egress proxy"
       );
-      await must(
-        ["network", "connect", "--alias", PROXY_ALIAS, network, proxy],
-        "connecting the proxy"
-      );
+      await retireSharedNetwork();
       await proxyListening();
-      log.info({ network, proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
+      log.info({ proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
     })().catch((err) => {
-      networkReady = null;
+      proxyReady = null;
       throw err;
     });
-    return networkReady;
+    return proxyReady;
+  };
+  const retireSharedNetwork = async () => {
+    if ((await docker.run(["network", "inspect", sharedNetwork])).code !== 0) return;
+    await docker.run(["network", "disconnect", "-f", sharedNetwork, proxy]);
+    const on = await docker.run(["ps", "-aq", "--filter", `network=${sharedNetwork}`]);
+    if (on.code === 0 && !on.stdout.trim()) await docker.run(["network", "rm", sharedNetwork]);
+  };
+  const networksOf = async (container) => (await docker.run([
+    "inspect",
+    "-f",
+    "{{range $k, $_ := .NetworkSettings.Networks}}{{$k}} {{end}}",
+    container
+  ])).stdout.split(/\s+/).filter(Boolean);
+  const ensurePairNetwork = async (net, attempt) => {
+    if ((await docker.run(["network", "inspect", net])).code !== 0) {
+      const made = await docker.run([
+        "network",
+        "create",
+        // No route off the host, and no address of the host's on the bridge:
+        // the host's own ports are out of reach too. The proxy is the only
+        // other thing on the network.
+        "--internal",
+        "-o",
+        "com.docker.network.bridge.inhibit_ipv4=true",
+        "--label",
+        `cabane.device=${opts.deviceKey}`,
+        "--label",
+        `cabane.conversation=${attempt.conversationId}`,
+        "--label",
+        `cabane.agent=${attempt.agentId}`,
+        net
+      ]);
+      if (made.code !== 0) throw networkCreateError(made.stderr);
+    }
+    if (!(await networksOf(proxy)).includes(net))
+      await must(
+        ["network", "connect", "--alias", PROXY_ALIAS, net, proxy],
+        "connecting the proxy"
+      );
+  };
+  const settleNetworks = async (name, net) => {
+    const on = await networksOf(name);
+    if (!on.includes(net)) await must(["network", "connect", net, name], "moving the container");
+    const others = on.filter((n) => n !== net);
+    for (const other of others)
+      await must(["network", "disconnect", "-f", other, name], "moving the container");
+    if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
   const socketRoot = opts.socketRoot ?? join17(
     process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir2(),
@@ -13657,7 +14065,7 @@ function createDockerProvider(opts) {
         "--label",
         `cabane.companion=${companionLabel}`,
         "--network",
-        network,
+        networkName(attempt),
         "--mount",
         `type=volume,src=${name}-home,dst=${CONTAINER_HOME}`,
         "--mount",
@@ -13683,6 +14091,17 @@ function createDockerProvider(opts) {
     await docker.run(["rm", "-f", "-v", name]);
     await docker.run(["volume", "rm", "-f", `${name}-home`, `${name}-work`]);
     rmSync9(socketDir(name), { recursive: true, force: true });
+    await dropNetwork(name);
+  };
+  const dropNetwork = async (name) => {
+    if ((await docker.run(["network", "inspect", name])).code !== 0) return;
+    await docker.run(["network", "disconnect", "-f", name, proxy]);
+    const gone = await docker.run(["network", "rm", name]);
+    if (gone.code !== 0)
+      log.warn(
+        { network: name, err: gone.stderr.trim() },
+        "runners: couldn't remove a pair's network"
+      );
   };
   const containerEnv = () => {
     const proxyUrl = `http://${PROXY_ALIAS}:${PROXY_PORT}`;
@@ -13849,7 +14268,7 @@ function createDockerProvider(opts) {
       });
       await before;
       try {
-        await ensureNetwork();
+        await ensureProxy();
         mkdirSync10(socketRoot, { recursive: true, mode: 448 });
         mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
         let seen = await docker.run([
@@ -13879,9 +14298,12 @@ function createDockerProvider(opts) {
           );
           seen = { code: 1, stdout: "", stderr: "" };
         }
+        await ensurePairNetwork(networkName(attempt), attempt);
         if (seen.code !== 0) {
           await create(name, attempt);
           log.debug({ container: name }, "runners: container created");
+        } else {
+          await settleNetworks(name, networkName(attempt));
         }
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
@@ -13895,7 +14317,8 @@ function createDockerProvider(opts) {
         return { provider: "docker", id: name };
       } catch (err) {
         const keep = opts.keepContainers || readPending(name).length > 0;
-        await (keep ? docker.run(["stop", "-t", "1", name]) : destroy(name)).catch(() => {
+        const kept = keep && (await docker.run(["inspect", "-f", "{{.Id}}", name])).code === 0;
+        await (kept ? docker.run(["stop", "-t", "1", name]) : keep ? dropNetwork(networkName(attempt)) : destroy(name)).catch(() => {
         });
         release();
         throw err;
@@ -14287,6 +14710,7 @@ var DeviceLocks = class {
 
 // src/supervisor.ts
 init_harness_sandbox();
+init_sandbox_policy();
 init_launch();
 
 // src/opencode-models.ts
@@ -14629,6 +15053,13 @@ var CompanionSupervisor = class {
       }
       this.latchBootBundledState();
     }
+    if (this.runnerSandbox() === "os") {
+      const policy = this.sandboxPolicy();
+      const posture = postureLines(policy);
+      const summary = posture.join("; ");
+      if (policy.ok) this.log.info({ posture }, `runners: OS sandbox policy \u2014 ${summary}`);
+      else this.log.error({ posture }, `runners: ${summary}`);
+    }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
@@ -15070,6 +15501,13 @@ var CompanionSupervisor = class {
   // CT1679: `runners.sandbox`, checked against this host once. A host that
   // can't make the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
+  // CT1684: `runners.policy`, parsed once. An invalid one is kept as the
+  // error, which every sandboxed turn is refused with.
+  parsedSandboxPolicy;
+  sandboxPolicy() {
+    this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
+    return this.parsedSandboxPolicy;
+  }
   runnerSandbox() {
     if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
@@ -15189,7 +15627,8 @@ var CompanionSupervisor = class {
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
-          sandbox: this.runnerSandbox()
+          sandbox: this.runnerSandbox(),
+          policy: this.sandboxPolicy()
         }
       } : {}
     });
@@ -15890,7 +16329,7 @@ function handleUncaught(log, err, origin) {
 
 // src/crash-marker.ts
 init_config();
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync11, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
 import { join as join20 } from "path";
 function crashMarkerPath() {
   return join20(cabaneDir(), "last-error.json");
@@ -16083,11 +16522,11 @@ import { closeSync as closeSync3, mkdirSync as mkdirSync14, openSync as openSync
 
 // src/cli-entry.ts
 import { existsSync as existsSync16 } from "fs";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 var RELATIVE_CANDIDATES = ["./cli.js", "../dist/cli.js", "../cli.js"];
 function companionCliEntry(deps = {}) {
   const exists = deps.exists ?? existsSync16;
-  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath4(new URL(rel, import.meta.url)));
+  const candidates = deps.candidates ?? RELATIVE_CANDIDATES.map((rel) => fileURLToPath5(new URL(rel, import.meta.url)));
   for (const candidate of candidates) {
     if (exists(candidate)) return candidate;
   }
@@ -16481,6 +16920,7 @@ async function runAttached(runtime) {
 // src/commands/status.ts
 init_config();
 import { readdirSync as readdirSync6 } from "fs";
+init_sandbox_policy();
 init_secrets();
 init_transcript_writer();
 async function status() {
@@ -16531,6 +16971,13 @@ async function status() {
     process.stdout.write(`prepare hook: ${cfg.prepareHook.command} (device-level, all agents)
 `);
   }
+  if (runnersEnabled(cfg) && cfg.runners?.sandbox === "os") {
+    process.stdout.write("sandbox:      os\n");
+    for (const line of postureLines(parseSandboxPolicy(cfg.runners.policy))) {
+      process.stdout.write(`  ${line}
+`);
+    }
+  }
   const overrides2 = Object.keys(cfg.agents ?? {});
   if (overrides2.length > 0) {
     process.stdout.write(`local overrides for: ${overrides2.join(", ")}
@@ -16623,7 +17070,7 @@ function isAlive(kill, pid) {
 init_errors();
 init_src();
 init_transcript_writer();
-import { existsSync as existsSync17, readFileSync as readFileSync12, readdirSync as readdirSync7 } from "fs";
+import { existsSync as existsSync17, readFileSync as readFileSync13, readdirSync as readdirSync7 } from "fs";
 import { isAbsolute, join as join21 } from "path";
 async function transcript(opts = {}) {
   const dir2 = transcriptsDir();
@@ -16724,7 +17171,7 @@ function isComplete(content) {
 async function followTranscripts(dir2) {
   const follower = new TranscriptFollower({
     listFiles: () => listFiles(dir2),
-    read: (f) => readFileSync12(join21(dir2, f), "utf8"),
+    read: (f) => readFileSync13(join21(dir2, f), "utf8"),
     write: (s) => process.stdout.write(s),
     // CSI: cursor up `n` lines, then erase from cursor to end of screen.
     clearLines: (n) => process.stdout.write(`\x1B[${n}A\x1B[0J`),
@@ -16785,7 +17232,7 @@ function peek(path) {
   let meta;
   let outcome;
   try {
-    for (const line of readFileSync12(path, "utf8").split("\n")) {
+    for (const line of readFileSync13(path, "utf8").split("\n")) {
       if (!line.trim()) continue;
       const o = safeParse(line);
       const t = str2(rec(o)?.type);
@@ -16818,7 +17265,7 @@ function resolveTarget(dir2, target) {
 function renderFile(path) {
   let content;
   try {
-    content = readFileSync12(path, "utf8");
+    content = readFileSync13(path, "utf8");
   } catch (err) {
     throw new CompanionError(
       `couldn't read ${path}: ${err instanceof Error ? err.message : String(err)}`
@@ -16980,7 +17427,7 @@ program.command("pair").description(
   });
 });
 program.command("write-paired-config", { hidden: true }).description("persist an already-completed device enrollment payload from stdin.").action(() => {
-  writeCompletedPairing(readFileSync13(0, "utf8"));
+  writeCompletedPairing(readFileSync14(0, "utf8"));
 });
 program.command("start").description(
   "pair this device if needed, connect a coding agent on it, and run in the background."