@cabane/companion 0.6.125 → 0.6.127

package/dist/runtime.js

@@ -358,6 +358,10 @@ var companionConfigSchema = z2.object({
   // wraps the runner in an OS sandbox where the host supports one; `'none'`
   // (the default) runs it as a plain child beside this process, a supported
   // configuration in its own right rather than a degraded one.
+  // CT1684: `policy` is what the OS sandbox lets a turn reach, read and hold
+  // (`runner/sandbox-policy.ts`). It is validated there rather than here, so a
+  // bad policy refuses the turns it governs, with the field named, instead of
+  // keeping the companion from starting at all.
   runners: z2.object({
     enabled: z2.boolean().optional(),
     provider: z2.enum(["local-process", "docker"]).optional(),
@@ -391,7 +395,8 @@ var companionConfigSchema = z2.object({
       // container's git for an allowed host, e.g. `!gh auth git-credential`.
       // Absent: git's own configured helpers on this device.
       gitCredentialHelper: z2.string().min(1).optional()
-    }).strict().optional()
+    }).strict().optional(),
+    policy: z2.unknown().optional()
   }).strict().optional()
 });
 function runnersEnabled(cfg) {
@@ -7872,6 +7877,149 @@ import { join as join14 } from "path";
 // src/runner/launch.ts
 import { createInterface } from "readline";
 
+// src/runner/sandbox-policy.ts
+import { NetworkConfigSchema } from "@anthropic-ai/sandbox-runtime";
+import { globToRegex } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
+import { z as z13 } from "zod";
+var hostPattern = z13.string().min(1);
+var secretRef = z13.string().regex(/^\$\{[A-Za-z_][A-Za-z0-9_]*\}$/, "must be a ${NAME} reference into secrets.json");
+var envCredentialSchema = z13.object({ secret: secretRef, hosts: z13.array(hostPattern).min(1) }).strict();
+var gitCredentialSchema = z13.object({
+  host: z13.string().regex(/^[A-Za-z0-9.-]+(:\d+)?$/, "must be a host name, like github.com"),
+  username: z13.string().min(1).optional(),
+  secret: secretRef
+}).strict();
+var sandboxPolicySchema = z13.object({
+  hosts: z13.object({
+    allow: z13.array(hostPattern).optional(),
+    deny: z13.array(hostPattern).optional(),
+    defaults: z13.boolean().optional()
+  }).strict().optional(),
+  filesystem: z13.object({
+    mode: z13.enum(["blocklist", "strict"]).optional(),
+    denyRead: z13.array(z13.string().min(1)).optional(),
+    allowRead: z13.array(z13.string().min(1)).optional(),
+    allowWrite: z13.array(z13.string().min(1)).optional()
+  }).strict().optional(),
+  credentials: z13.object({
+    env: z13.record(z13.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), envCredentialSchema).optional(),
+    git: z13.array(gitCredentialSchema).optional()
+  }).strict().optional()
+}).strict();
+function parseSandboxPolicy(raw) {
+  if (raw === void 0) return { ok: true, policy: {} };
+  const result = sandboxPolicySchema.safeParse(raw);
+  if (!result.success) {
+    const issue = result.error.issues[0];
+    return { ok: false, error: `${fieldPath(issue.path)}: ${issue.message}` };
+  }
+  const refused = unenforceable(result.data);
+  return refused ? { ok: false, error: refused } : { ok: true, policy: result.data };
+}
+function fieldPath(path) {
+  return ["runners", "policy", ...path.map(String)].join(".");
+}
+function unenforceable(policy) {
+  const hostLists = [
+    ["hosts.allow", "allowedDomains", policy.hosts?.allow],
+    ["hosts.deny", "deniedDomains", policy.hosts?.deny],
+    ...Object.entries(policy.credentials?.env ?? {}).map(
+      ([name, entry]) => [
+        `credentials.env.${name}.hosts`,
+        "allowedDomains",
+        entry.hosts
+      ]
+    )
+  ];
+  for (const [field, as, hosts] of hostLists) {
+    for (const [i, host] of (hosts ?? []).entries()) {
+      const check = NetworkConfigSchema.safeParse({
+        allowedDomains: as === "allowedDomains" ? [host] : [],
+        deniedDomains: as === "deniedDomains" ? [host] : []
+      });
+      if (!check.success) {
+        const message = check.error.issues[0]?.message ?? "not a host pattern the sandbox accepts";
+        return `runners.policy.${field}.${i}: ${message}`;
+      }
+    }
+  }
+  const pathLists = [
+    ["filesystem.denyRead", policy.filesystem?.denyRead],
+    ["filesystem.allowRead", policy.filesystem?.allowRead],
+    ["filesystem.allowWrite", policy.filesystem?.allowWrite]
+  ];
+  for (const [field, paths] of pathLists) {
+    for (const [i, path] of (paths ?? []).entries()) {
+      try {
+        new RegExp(globToRegex(path));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return `runners.policy.${field}.${i}: not a pattern the sandbox can match (${message})`;
+      }
+    }
+  }
+  return null;
+}
+var placeholderName = (ref) => ref.slice(2, -1);
+function gitAuthVar(index) {
+  return `CABANE_GIT_AUTH_${index}`;
+}
+function resolvePolicyCredentials(policy, store) {
+  const missing = /* @__PURE__ */ new Set();
+  const credentials = [];
+  const lookup2 = (ref) => {
+    const name = placeholderName(ref);
+    const value = store.get(name);
+    if (value === void 0) missing.add(name);
+    return value;
+  };
+  for (const [name, entry] of Object.entries(policy.credentials?.env ?? {})) {
+    const value = lookup2(entry.secret);
+    if (value === void 0) continue;
+    credentials.push({ name, value, hosts: entry.hosts });
+  }
+  (policy.credentials?.git ?? []).forEach((entry, i) => {
+    const secret = lookup2(entry.secret);
+    if (secret === void 0) return;
+    const user = entry.username ?? "x-access-token";
+    credentials.push({
+      name: gitAuthVar(i),
+      value: Buffer.from(`${user}:${secret}`).toString("base64"),
+      hosts: [entry.host.replace(/:\d+$/, "")],
+      gitHost: entry.host
+    });
+  });
+  return { credentials, missing: [...missing].sort() };
+}
+var HarnessSandboxRefused = class extends Error {
+};
+function policyHasCredentials(policy) {
+  return Object.keys(policy.credentials?.env ?? {}).length > 0 || (policy.credentials?.git ?? []).length > 0;
+}
+function postureLines(parsed) {
+  if (!parsed.ok) return [`policy invalid \u2014 turns are refused until it's fixed: ${parsed.error}`];
+  const { policy } = parsed;
+  const mode = policy.filesystem?.mode ?? "blocklist";
+  const defaults = policy.hosts?.defaults !== false;
+  const lines2 = [
+    `filesystem: ${mode}${mode === "strict" ? " (home unreadable except the checkout, harness state and allowRead)" : ""}`,
+    `hosts: Cabane + the turn's model provider${defaults ? " + defaults (GitHub, npm, PyPI, crates.io)" : ""}${policy.hosts?.allow?.length ? ` + ${policy.hosts.allow.join(", ")}` : ""}`
+  ];
+  if (policy.hosts?.deny?.length) lines2.push(`hosts denied: ${policy.hosts.deny.join(", ")}`);
+  const extraDeny = policy.filesystem?.denyRead ?? [];
+  if (extraDeny.length) lines2.push(`denied reads (extra): ${extraDeny.join(", ")}`);
+  const allowRead = policy.filesystem?.allowRead ?? [];
+  if (allowRead.length) lines2.push(`reads allowed back: ${allowRead.join(", ")}`);
+  const allowWrite = policy.filesystem?.allowWrite ?? [];
+  if (allowWrite.length) lines2.push(`writes allowed (extra): ${allowWrite.join(", ")}`);
+  const env = Object.keys(policy.credentials?.env ?? {});
+  const git = (policy.credentials?.git ?? []).map((g) => `git@${g.host}`);
+  if (env.length || git.length) {
+    lines2.push(`masked credentials: ${[...env, ...git].join(", ")}`);
+  }
+  return lines2;
+}
+
 // src/runner/opencode-lock.ts
 function opencodeLockKey(serverUrl) {
   return `opencode:${serverUrl}`;
@@ -8185,12 +8333,12 @@ function createTurnContainment(turnId, deps = {}) {
 // src/secrets.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
 import { join as join10 } from "path";
-import { z as z13 } from "zod";
+import { z as z14 } from "zod";
 var PLACEHOLDER_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
 function secretsPath() {
   return join10(cabaneDir(), "secrets.json");
 }
-var secretStoreSchema = z13.record(z13.string(), z13.string());
+var secretStoreSchema = z14.record(z14.string(), z14.string());
 function loadSecretStore() {
   const path = secretsPath();
   if (!existsSync7(path)) return makeStore({});
@@ -8272,44 +8420,55 @@ function resolveMcpSecrets(mcpServers, store) {
   }
   return { servers, missing: [...missing].sort() };
 }
+var ERROR_REASON_MAX = 200;
+function missingSecretReason(missing) {
+  const prefix = "missing_secret: ";
+  for (let shown = missing.length; shown >= 0; shown--) {
+    const omitted = missing.length - shown;
+    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
+    const reason = prefix + parts.join(",");
+    if (reason.length <= ERROR_REASON_MAX) return reason;
+  }
+  return `${prefix}+${missing.length}`;
+}
 
 // src/runner/protocol.ts
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 
 // src/run-config.ts
-import { z as z14 } from "zod";
-var mcpStdioServerSchema = z14.object({
-  type: z14.literal("stdio").optional(),
-  command: z14.string().min(1),
-  args: z14.array(z14.string()).optional(),
-  env: z14.record(z14.string(), z14.string()).optional()
+import { z as z15 } from "zod";
+var mcpStdioServerSchema = z15.object({
+  type: z15.literal("stdio").optional(),
+  command: z15.string().min(1),
+  args: z15.array(z15.string()).optional(),
+  env: z15.record(z15.string(), z15.string()).optional()
 });
-var mcpHttpServerSchema = z14.object({
-  type: z14.literal("http"),
-  url: z14.string().url(),
-  headers: z14.record(z14.string(), z14.string()).optional()
+var mcpHttpServerSchema = z15.object({
+  type: z15.literal("http"),
+  url: z15.string().url(),
+  headers: z15.record(z15.string(), z15.string()).optional()
 });
-var mcpSseServerSchema = z14.object({
-  type: z14.literal("sse"),
-  url: z14.string().url(),
-  headers: z14.record(z14.string(), z14.string()).optional()
+var mcpSseServerSchema = z15.object({
+  type: z15.literal("sse"),
+  url: z15.string().url(),
+  headers: z15.record(z15.string(), z15.string()).optional()
 });
-var mcpServerDefSchema = z14.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
-var thinkingConfigSchema = z14.discriminatedUnion("type", [
-  z14.object({ type: z14.literal("adaptive") }),
-  z14.object({ type: z14.literal("enabled"), budgetTokens: z14.number().int().positive().optional() }),
-  z14.object({ type: z14.literal("disabled") })
+var mcpServerDefSchema = z15.union([mcpHttpServerSchema, mcpSseServerSchema, mcpStdioServerSchema]);
+var thinkingConfigSchema = z15.discriminatedUnion("type", [
+  z15.object({ type: z15.literal("adaptive") }),
+  z15.object({ type: z15.literal("enabled"), budgetTokens: z15.number().int().positive().optional() }),
+  z15.object({ type: z15.literal("disabled") })
 ]);
-var effortSchema = z14.enum(["low", "medium", "high", "xhigh", "max"]);
-var runConfigSchema = z14.object({
+var effortSchema = z15.enum(["low", "medium", "high", "xhigh", "max"]);
+var runConfigSchema = z15.object({
   // CT788: the host-access binary replaced the `assistant`/`coding`/`custom` mode
   // trio + its custom tool lists — `true` grants the host filesystem/shell, absent
   // is the locked surface. Kept in lockstep with `@cabane/shared`'s
   // `agentRunConfigSchema` (independent zod, forward-compatible: unknown keys are
   // stripped, so an older companion riding a newer server never rejects the config).
-  hostAccess: z14.boolean().optional(),
-  mcpServers: z14.record(z14.string(), mcpServerDefSchema).optional(),
-  model: z14.string().min(1).optional(),
+  hostAccess: z15.boolean().optional(),
+  mcpServers: z15.record(z15.string(), mcpServerDefSchema).optional(),
+  model: z15.string().min(1).optional(),
   thinking: thinkingConfigSchema.optional(),
   effort: effortSchema.optional()
 });
@@ -8337,64 +8496,75 @@ var RUNNER_ENV = {
   // Everything else the turn is constructed from, as JSON: see `RunnerSpec`.
   spec: "CABANE_RUNNER_SPEC"
 };
-var runtimeHealthSchema = z15.object({
-  quotaState: z15.enum(["ok", "limited", "auth_expired", "unknown"]),
-  limitedUntil: z15.string().nullable(),
-  lastError: z15.string().nullable()
+var runtimeHealthSchema = z16.object({
+  quotaState: z16.enum(["ok", "limited", "auth_expired", "unknown"]),
+  limitedUntil: z16.string().nullable(),
+  lastError: z16.string().nullable()
 });
-var runnerSpecSchema = z15.object({
-  deviceId: z15.string().optional(),
+var runnerSpecSchema = z16.object({
+  deviceId: z16.string().optional(),
   // The launcher's boot id: the one its heartbeat carries, so a runner's lease
   // matches the device that holds it.
-  bootId: z15.string(),
-  workspaceId: z15.string(),
-  workspaceSlug: z15.string(),
-  agentId: z15.string(),
-  agentUsername: z15.string(),
-  agentName: z15.string(),
+  bootId: z16.string(),
+  workspaceId: z16.string(),
+  workspaceSlug: z16.string(),
+  agentId: z16.string(),
+  agentUsername: z16.string(),
+  agentName: z16.string(),
   local: localAgentConfigSchema,
   runConfig: runConfigSchema,
-  opencodeServerUrl: z15.string().optional(),
-  claudeCodeAvailable: z15.boolean(),
-  codexAvailable: z15.boolean(),
-  idleTimeoutMs: z15.number().int().positive().optional(),
-  totalTimeoutMs: z15.number().int().positive().optional(),
-  leaseRenewalMs: z15.number().int().positive().optional(),
-  preparingRowDelayMs: z15.number().int().nonnegative().optional(),
+  opencodeServerUrl: z16.string().optional(),
+  claudeCodeAvailable: z16.boolean(),
+  codexAvailable: z16.boolean(),
+  idleTimeoutMs: z16.number().int().positive().optional(),
+  totalTimeoutMs: z16.number().int().positive().optional(),
+  leaseRenewalMs: z16.number().int().positive().optional(),
+  preparingRowDelayMs: z16.number().int().nonnegative().optional(),
   // Whether the turn writes a transcript. The directory is the runner's own
   // (`transcriptsDir()`), so `CABANE_RUNNER_STATE_DIR` moves it with the outbox.
-  transcripts: z15.boolean(),
+  transcripts: z16.boolean(),
   // Whether the harness starts under the OS sandbox. The launcher sends 'os'
   // only when this host can make one.
-  sandbox: z15.enum(["os", "none"]),
-  logLevel: z15.string(),
+  sandbox: z16.enum(["os", "none"]),
+  // CT1684: the device's sandbox policy, validated by the launcher. Absent
+  // when the sandbox is off.
+  sandboxPolicy: sandboxPolicySchema.optional(),
+  logLevel: z16.string(),
   // The launcher's connector-health observations, by runtime, as of the start.
-  connectorHealth: z15.record(z15.string(), runtimeHealthSchema),
+  connectorHealth: z16.record(z16.string(), runtimeHealthSchema),
   // True when this (conversation, agent) pair was already told its session
   // could not be saved: the notice is once per pair, not once per process.
-  sessionWriteNoticeClaimed: z15.boolean(),
+  sessionWriteNoticeClaimed: z16.boolean(),
   // CT1680: the runner's identity, minted with its credential. The start
   // PATCH carries it so the lease knows which runner holds the span.
-  runnerId: z15.string(),
+  runnerId: z16.string(),
   // CT1681: the launcher keeps the runtime's session files beside the attempt
   // and restores them into this runner's home, so the runner names the attempt
   // each context was composed for and waits for the launcher to say it's in
   // place. Absent: nothing to wait for (a runner on the launcher's own disk).
-  attemptState: z15.boolean().optional(),
+  attemptState: z16.boolean().optional(),
   // CT1681: MCP `${NAME}` secrets come from the launcher, by name, instead of
   // this machine's secrets.json. Absent: the runner reads the device's file.
-  secretsFromLauncher: z15.boolean().optional()
+  secretsFromLauncher: z16.boolean().optional()
 });
-var dispatchSchema = z15.object({
-  type: z15.literal("device:dispatch_requested"),
-  agentId: z15.string(),
-  deviceId: z15.string(),
-  conversationId: z15.string(),
-  messageId: z15.string(),
-  episode: z15.number().int().optional()
+var dispatchSchema = z16.object({
+  type: z16.literal("device:dispatch_requested"),
+  agentId: z16.string(),
+  deviceId: z16.string(),
+  conversationId: z16.string(),
+  messageId: z16.string(),
+  episode: z16.number().int().optional()
 });
-var credentialsSchema = z15.object({
-  credential: z15.string().startsWith("cabrn_")
+var credentialsSchema = z16.object({
+  credential: z16.string().startsWith("cabrn_"),
+  sandboxCredentials: z16.array(
+    z16.object({
+      name: z16.string(),
+      value: z16.string(),
+      hosts: z16.array(z16.string()),
+      gitHost: z16.string().optional()
+    })
+  ).optional()
 });
 function runnerEnv(input) {
   return {
@@ -8406,7 +8576,10 @@ function runnerEnv(input) {
   };
 }
 function runnerStdin(input) {
-  return `${JSON.stringify({ credential: input.credential })}
+  return `${JSON.stringify({
+    credential: input.credential,
+    ...input.sandboxCredentials?.length ? { sandboxCredentials: input.sandboxCredentials } : {}
+  })}
 `;
 }
 function encodeLauncherMessage(message) {
@@ -8471,6 +8644,7 @@ function runnerSpec(opts, launch, duties, runnerId) {
     sandbox: launch.sandbox ?? "none",
     ...launch.provider.bindAttempt ? { attemptState: true } : {},
     ...launch.provider.inheritsEnvironment === false ? { secretsFromLauncher: true } : {},
+    ...launch.sandbox === "os" && launch.policy?.ok ? { sandboxPolicy: launch.policy.policy } : {},
     logLevel: opts.log.level,
     connectorHealth: healthSnapshot(launch.connectorHealth),
     sessionWriteNoticeClaimed: duties.sessionWriteNoticeClaimed()
@@ -8577,6 +8751,32 @@ async function settleUnstarted(opts, payload, turnId, errorReason, log) {
     );
   }
 }
+function sandboxInputs(launch, log) {
+  const policy = launch.policy ?? { ok: true, policy: {} };
+  if (launch.sandbox !== "os") {
+    if (policy.ok && policyHasCredentials(policy.policy)) {
+      log.debug(
+        "runners: runners.policy names credentials, but turns here run without the OS sandbox; none are given to the harness"
+      );
+    }
+    return { ok: true, credentials: [] };
+  }
+  if (!policy.ok) {
+    log.warn({ error: policy.error }, "runners: the sandbox policy is invalid; refusing the turn");
+    return { ok: false, reason: `setup_failed: ${policy.error}`.slice(0, 200) };
+  }
+  if (!policyHasCredentials(policy.policy)) return { ok: true, credentials: [] };
+  const store = (launch.secretStore ?? defaultSecretStore)(log);
+  const { credentials, missing } = resolvePolicyCredentials(policy.policy, store);
+  if (missing.length) {
+    log.debug(
+      { missing },
+      "runners: the sandbox policy names secrets this device does not declare"
+    );
+    return { ok: false, reason: missingSecretReason(missing) };
+  }
+  return { ok: true, credentials };
+}
 async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
   const startedAt = Date.now();
   const { turnId } = handleOpts;
@@ -8600,7 +8800,8 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     agentId: payload.agentId,
     turnId
   };
-  const minted = await mintForRunner(opts, payload, handleOpts, controller.signal, log);
+  const sandboxed = sandboxInputs(launch, log);
+  const minted = sandboxed.ok ? await mintForRunner(opts, payload, handleOpts, controller.signal, log) : { ok: false, reason: sandboxed.reason, errorReason: sandboxed.reason };
   if (!minted.ok) {
     controller.signal.removeEventListener("abort", forwardStop);
     duties.releaseAbort(turnId, controller);
@@ -8653,6 +8854,7 @@ async function runTurnInRunner(opts, launch, duties, payload, handleOpts) {
     const input = {
       baseUrl: launch.runnerBaseUrl ?? opts.baseUrl,
       credential: minted.credential,
+      sandboxCredentials: sandboxed.ok ? sandboxed.credentials : [],
       dispatch: payload,
       turnId,
       resumed: handleOpts.resumed,
@@ -8837,7 +9039,7 @@ import { existsSync as existsSync9 } from "fs";
 
 // src/turn-control-tools.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { z as z16 } from "zod";
+import { z as z17 } from "zod";
 var COMPANION_LOCAL_MCP_SERVER = "cabane_companion";
 var COMPANION_LOCAL_TOOL_GLOB = `mcp__${COMPANION_LOCAL_MCP_SERVER}__*`;
 var SKIP_TURN_TOOL = "skip_turn";
@@ -8900,7 +9102,7 @@ function createTurnControlMcpServer(acts, skipState) {
           SKIP_TURN_TOOL,
           TURN_CONTROL_TOOL_DESCRIPTIONS.skip_turn,
           {
-            reason: z16.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
+            reason: z17.string().min(1).max(MAX_SKIP_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.skip_turn.reason)
           },
           async (args) => {
             skipState.skipped = true;
@@ -8916,42 +9118,42 @@ function createTurnControlMcpServer(acts, skipState) {
         ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.ask,
         {
-          targetUserId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
-          question: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
-          headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
-          options: z16.array(
-            z16.union([
-              z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
-              z16.object({
-                label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
-                move: z16.object({
-                  task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
-                  status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
+          targetUserId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.targetUserId),
+          question: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.question),
+          headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.headline),
+          options: z17.array(
+            z17.union([
+              z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+              z17.object({
+                label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.label"]),
+                move: z17.object({
+                  task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.task"]),
+                  status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move.status"])
                 }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["options.move"])
               })
             ])
           ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.options),
-          questions: z16.array(
-            z16.object({
-              headline: z16.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
-              body: z16.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
-              options: z16.array(
-                z16.union([
-                  z16.string().min(1).max(MAX_ASK_OPTION_BYTES),
-                  z16.object({
-                    label: z16.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
-                    move: z16.object({
-                      task: z16.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
-                      status: z16.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
+          questions: z17.array(
+            z17.object({
+              headline: z17.string().min(1).max(MAX_ASK_HEADLINE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.headline"]),
+              body: z17.string().min(1).max(MAX_ASK_QUESTION_BYTES).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.body"]),
+              options: z17.array(
+                z17.union([
+                  z17.string().min(1).max(MAX_ASK_OPTION_BYTES),
+                  z17.object({
+                    label: z17.string().min(1).max(MAX_ASK_OPTION_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.label"]),
+                    move: z17.object({
+                      task: z17.string().min(1).max(200).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.task"]),
+                      status: z17.enum(TASK_STAGES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move.status"])
                     }).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options.move"])
                   })
                 ])
               ).min(MIN_ASK_OPTIONS).max(MAX_ASK_OPTIONS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["questions.options"])
             })
           ).min(1).max(MAX_ASK_ITEMS).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.questions),
-          replaces: z16.object({
-            askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
-            reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
+          replaces: z17.object({
+            askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.askId"]),
+            reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask["replaces.reason"])
           }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.ask.replaces)
         },
         async (args) => {
@@ -8992,9 +9194,9 @@ function createTurnControlMcpServer(acts, skipState) {
         WAKE_ME_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.wake_me,
         {
-          afterSeconds: z16.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
-          at: z16.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
-          note: z16.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
+          afterSeconds: z17.number().int().positive().optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.afterSeconds),
+          at: z17.string().datetime({ offset: true }).optional().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.at),
+          note: z17.string().min(1).max(MAX_WAKE_NOTE_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.wake_me.note)
         },
         async (args) => {
           const hasAfter = args.afterSeconds !== void 0;
@@ -9028,8 +9230,8 @@ function createTurnControlMcpServer(acts, skipState) {
         WITHDRAW_ASK_TOOL,
         TURN_CONTROL_TOOL_DESCRIPTIONS.withdraw_ask,
         {
-          askId: z16.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
-          reason: z16.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
+          askId: z17.string().uuid().describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.askId),
+          reason: z17.string().min(1).max(MAX_WITHDRAW_REASON_BYTES).describe(TURN_CONTROL_FIELD_DESCRIPTIONS.withdraw_ask.reason)
         },
         async (args) => performAct(acts, {
           kind: "withdraw_ask",
@@ -9548,17 +9750,6 @@ async function absorbBundledLoss(ctx, aborted, outcome) {
 
 // src/turn-execution.ts
 var PREPARING_TOOL_NAME = "preparing";
-var ERROR_REASON_MAX = 200;
-function missingSecretReason(missing) {
-  const prefix = "missing_secret: ";
-  for (let shown = missing.length; shown >= 0; shown--) {
-    const omitted = missing.length - shown;
-    const parts = [...missing.slice(0, shown), ...omitted > 0 ? [`+${omitted}`] : []];
-    const reason = prefix + parts.join(",");
-    if (reason.length <= ERROR_REASON_MAX) return reason;
-  }
-  return `${prefix}+${missing.length}`;
-}
 var RUNTIME_UNAVAILABLE_PREFIX = "**This agent's runtime isn't available on this companion.** The model this agent uses needs a runtime this device isn't running, so I can't run this turn here. Details:";
 var NO_TURN_TOKEN_REASON = "no_turn_token: the server issued no turn credential for this turn";
 var UNEXPECTED_ROLE_REASON = `refused the wake trigger (role "system" isn't dispatchable on this companion) \u2014 the companion is likely running outdated code; refresh it, then re-address the agent`;
@@ -10147,7 +10338,18 @@ var TurnExecution = class {
     const { payload, workspaceId, turnId, turnLog } = this;
     await guardBundledBinary(this.integrityContext(), (r, e) => this.concluded(r, e), this.outcome);
     const onWarn = (msg, meta) => turnLog.debug(meta ?? {}, msg);
-    const sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({ cwd: this.effectiveCwd, log: turnLog }) : null;
+    let sandbox = null;
+    try {
+      sandbox = this.opts.harnessSandbox ? await this.opts.harnessSandbox({
+        cwd: this.effectiveCwd,
+        runtime: this.turnContext.runtime,
+        log: turnLog
+      }) : null;
+    } catch (err) {
+      if (!(err instanceof HarnessSandboxRefused)) throw err;
+      const reason = `setup_failed: ${err.message}`.slice(0, 200);
+      throw this.concluded(reason, reason);
+    }
     const adapters = [];
     if (this.opts.claudeCodeAvailable?.() ?? true) {
       this.containment = createTurnContainment(this.turnId, {
@@ -11325,6 +11527,15 @@ var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function containerName(attempt) {
   return `cabane-runner-${attempt.conversationId}-${attempt.agentId}`;
 }
+var networkName = containerName;
+function networkCreateError(stderr) {
+  const said = stderr.trim();
+  if (/address pool|fully subnetted/i.test(said))
+    return new Error(
+      `docker: couldn't create this conversation's runner network: the engine has no address pool left for another network. Each conversation and agent with a runner container holds one; remove kept runner containers, or widen \`default-address-pools\` in the daemon.json. Docker said: ${said}`
+    );
+  return new Error(`docker: creating the runner network failed: ${said || "no reason given"}`);
+}
 function sessionArchivePath(deviceDir, attemptId) {
   if (!UUID_RE.test(attemptId)) throw new Error(`docker: not an attempt id: ${attemptId}`);
   return join17(deviceDir, "attempts", attemptId, "session.tar");
@@ -11401,7 +11612,7 @@ function createDockerProvider(opts) {
   const killGraceMs = opts.killGraceMs ?? DEFAULT_KILL_GRACE_MS2;
   const sessionCap = opts.sessionCapBytes ?? DEFAULT_SESSION_CAP_BYTES;
   const collectCap = opts.collectCapBytes ?? COLLECT_CAP_BYTES;
-  const network = `cabane-runners-${opts.deviceKey}`;
+  const sharedNetwork = `cabane-runners-${opts.deviceKey}`;
   const companionLabel = createHash4("sha256").update(opts.companion.key).digest("hex").slice(0, 16);
   const proxy = `cabane-egress-${opts.deviceKey}`;
   const held = /* @__PURE__ */ new Map();
@@ -11434,32 +11645,14 @@ function createDockerProvider(opts) {
     }
     throw new Error("docker: the egress proxy never started listening");
   };
-  let networkReady = null;
+  let proxyReady = null;
   const proxyKey = async () => {
     const id = (await docker.run(["image", "inspect", "-f", "{{.Id}}", opts.image])).stdout.trim();
     return createHash4("sha256").update(JSON.stringify([id || opts.image, opts.companion.key, [...opts.egressAllow].sort()])).digest("hex").slice(0, 16);
   };
-  const ensureNetwork = () => {
-    networkReady ??= (async () => {
+  const ensureProxy = () => {
+    proxyReady ??= (async () => {
       const allowKey = await proxyKey();
-      if ((await docker.run(["network", "inspect", network])).code !== 0) {
-        await must(
-          [
-            "network",
-            "create",
-            // No route off the host, and no address of the host's on the
-            // bridge: the host's own ports are out of reach too. The proxy is
-            // the only other thing on the network.
-            "--internal",
-            "-o",
-            "com.docker.network.bridge.inhibit_ipv4=true",
-            "--label",
-            `cabane.device=${opts.deviceKey}`,
-            network
-          ],
-          "creating the runners network"
-        );
-      }
       const seen = await docker.run([
         "inspect",
         "-f",
@@ -11468,6 +11661,7 @@ function createDockerProvider(opts) {
       ]);
       const [key, running] = seen.stdout.trim().split(" ");
       if (seen.code === 0 && key === allowKey) {
+        await retireSharedNetwork();
         if (running !== "true") {
           await must(["start", proxy], "starting the egress proxy");
           await proxyListening();
@@ -11502,17 +11696,61 @@ function createDockerProvider(opts) {
         ],
         "starting the egress proxy"
       );
-      await must(
-        ["network", "connect", "--alias", PROXY_ALIAS, network, proxy],
-        "connecting the proxy"
-      );
+      await retireSharedNetwork();
       await proxyListening();
-      log.info({ network, proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
+      log.info({ proxy, allow: opts.egressAllow }, "runners: egress proxy ready");
     })().catch((err) => {
-      networkReady = null;
+      proxyReady = null;
       throw err;
     });
-    return networkReady;
+    return proxyReady;
+  };
+  const retireSharedNetwork = async () => {
+    if ((await docker.run(["network", "inspect", sharedNetwork])).code !== 0) return;
+    await docker.run(["network", "disconnect", "-f", sharedNetwork, proxy]);
+    const on = await docker.run(["ps", "-aq", "--filter", `network=${sharedNetwork}`]);
+    if (on.code === 0 && !on.stdout.trim()) await docker.run(["network", "rm", sharedNetwork]);
+  };
+  const networksOf = async (container) => (await docker.run([
+    "inspect",
+    "-f",
+    "{{range $k, $_ := .NetworkSettings.Networks}}{{$k}} {{end}}",
+    container
+  ])).stdout.split(/\s+/).filter(Boolean);
+  const ensurePairNetwork = async (net, attempt) => {
+    if ((await docker.run(["network", "inspect", net])).code !== 0) {
+      const made = await docker.run([
+        "network",
+        "create",
+        // No route off the host, and no address of the host's on the bridge:
+        // the host's own ports are out of reach too. The proxy is the only
+        // other thing on the network.
+        "--internal",
+        "-o",
+        "com.docker.network.bridge.inhibit_ipv4=true",
+        "--label",
+        `cabane.device=${opts.deviceKey}`,
+        "--label",
+        `cabane.conversation=${attempt.conversationId}`,
+        "--label",
+        `cabane.agent=${attempt.agentId}`,
+        net
+      ]);
+      if (made.code !== 0) throw networkCreateError(made.stderr);
+    }
+    if (!(await networksOf(proxy)).includes(net))
+      await must(
+        ["network", "connect", "--alias", PROXY_ALIAS, net, proxy],
+        "connecting the proxy"
+      );
+  };
+  const settleNetworks = async (name, net) => {
+    const on = await networksOf(name);
+    if (!on.includes(net)) await must(["network", "connect", net, name], "moving the container");
+    const others = on.filter((n) => n !== net);
+    for (const other of others)
+      await must(["network", "disconnect", "-f", other, name], "moving the container");
+    if (others.includes(sharedNetwork)) await retireSharedNetwork();
   };
   const socketRoot = opts.socketRoot ?? join17(
     process.env.XDG_RUNTIME_DIR && existsSync13(process.env.XDG_RUNTIME_DIR) ? process.env.XDG_RUNTIME_DIR : tmpdir2(),
@@ -11544,7 +11782,7 @@ function createDockerProvider(opts) {
         "--label",
         `cabane.companion=${companionLabel}`,
         "--network",
-        network,
+        networkName(attempt),
         "--mount",
         `type=volume,src=${name}-home,dst=${CONTAINER_HOME}`,
         "--mount",
@@ -11570,6 +11808,17 @@ function createDockerProvider(opts) {
     await docker.run(["rm", "-f", "-v", name]);
     await docker.run(["volume", "rm", "-f", `${name}-home`, `${name}-work`]);
     rmSync9(socketDir(name), { recursive: true, force: true });
+    await dropNetwork(name);
+  };
+  const dropNetwork = async (name) => {
+    if ((await docker.run(["network", "inspect", name])).code !== 0) return;
+    await docker.run(["network", "disconnect", "-f", name, proxy]);
+    const gone = await docker.run(["network", "rm", name]);
+    if (gone.code !== 0)
+      log.warn(
+        { network: name, err: gone.stderr.trim() },
+        "runners: couldn't remove a pair's network"
+      );
   };
   const containerEnv = () => {
     const proxyUrl = `http://${PROXY_ALIAS}:${PROXY_PORT}`;
@@ -11736,7 +11985,7 @@ function createDockerProvider(opts) {
       });
       await before;
       try {
-        await ensureNetwork();
+        await ensureProxy();
         mkdirSync10(socketRoot, { recursive: true, mode: 448 });
         mkdirSync10(socketDir(name), { recursive: true, mode: 457 });
         let seen = await docker.run([
@@ -11766,9 +12015,12 @@ function createDockerProvider(opts) {
           );
           seen = { code: 1, stdout: "", stderr: "" };
         }
+        await ensurePairNetwork(networkName(attempt), attempt);
         if (seen.code !== 0) {
           await create(name, attempt);
           log.debug({ container: name }, "runners: container created");
+        } else {
+          await settleNetworks(name, networkName(attempt));
         }
         if (seen.stdout.trim().split(" ")[0] !== "true")
           await must(["start", name], "starting the container");
@@ -11782,7 +12034,8 @@ function createDockerProvider(opts) {
         return { provider: "docker", id: name };
       } catch (err) {
         const keep = opts.keepContainers || readPending(name).length > 0;
-        await (keep ? docker.run(["stop", "-t", "1", name]) : destroy(name)).catch(() => {
+        const kept = keep && (await docker.run(["inspect", "-f", "{{.Id}}", name])).code === 0;
+        await (kept ? docker.run(["stop", "-t", "1", name]) : keep ? dropNetwork(networkName(attempt)) : destroy(name)).catch(() => {
         });
         release();
         throw err;
@@ -12171,10 +12424,20 @@ var DeviceLocks = class {
 
 // src/runner/harness-sandbox.ts
 import { lookup } from "dns/promises";
-import { chmodSync as chmodSync6, mkdirSync as mkdirSync11, mkdtempSync, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
+import {
+  chmodSync as chmodSync6,
+  mkdirSync as mkdirSync11,
+  mkdtempSync,
+  readFileSync as readFileSync10,
+  realpathSync as realpathSync3,
+  rmSync as rmSync10,
+  writeFileSync as writeFileSync7
+} from "fs";
+import { createRequire as createRequire2 } from "module";
 import { isIP } from "net";
 import { homedir as homedir3, networkInterfaces, tmpdir as tmpdir3, userInfo as userInfo2 } from "os";
-import { join as join18 } from "path";
+import { dirname as dirname8, join as join18 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
 import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
 function osSandboxUsable(log) {
   if (!SandboxManager.isSupportedPlatform()) {
@@ -12276,7 +12539,7 @@ import {
   existsSync as existsSync14,
   mkdirSync as mkdirSync12,
   readdirSync as readdirSync5,
-  readFileSync as readFileSync10,
+  readFileSync as readFileSync11,
   renameSync as renameSync6,
   rmSync as rmSync11,
   writeFileSync as writeFileSync8
@@ -12341,7 +12604,7 @@ var Outbox = class {
       if (!name.endsWith(".json")) continue;
       const full = join19(dir2, name);
       try {
-        const parsed = JSON.parse(readFileSync10(full, "utf8"));
+        const parsed = JSON.parse(readFileSync11(full, "utf8"));
         if (parsed && typeof parsed.turnId === "string" && typeof parsed.seq === "number" && typeof parsed.path === "string") {
           entries.push(parsed);
         } else {
@@ -12551,8 +12814,8 @@ function sleep3(ms) {
 }
 
 // src/version.ts
-import { createRequire as createRequire2 } from "module";
-var pkg = createRequire2(import.meta.url)("../package.json");
+import { createRequire as createRequire3 } from "module";
+var pkg = createRequire3(import.meta.url)("../package.json");
 var COMPANION_VERSION = pkg.version;
 
 // src/supervisor.ts
@@ -12702,6 +12965,13 @@ var CompanionSupervisor = class {
       }
       this.latchBootBundledState();
     }
+    if (this.runnerSandbox() === "os") {
+      const policy = this.sandboxPolicy();
+      const posture = postureLines(policy);
+      const summary = posture.join("; ");
+      if (policy.ok) this.log.info({ posture }, `runners: OS sandbox policy \u2014 ${summary}`);
+      else this.log.error({ posture }, `runners: ${summary}`);
+    }
     const startupHarnessRefresh = this.refreshHarnessStatuses();
     this.trackHeartbeat(startupHarnessRefresh);
     if (!this.config.deviceToken) {
@@ -13143,6 +13413,13 @@ var CompanionSupervisor = class {
   // CT1679: `runners.sandbox`, checked against this host once. A host that
   // can't make the sandbox says so once and runs its turns unwrapped.
   sandboxUsable;
+  // CT1684: `runners.policy`, parsed once. An invalid one is kept as the
+  // error, which every sandboxed turn is refused with.
+  parsedSandboxPolicy;
+  sandboxPolicy() {
+    this.parsedSandboxPolicy ??= parseSandboxPolicy(this.config.runners?.policy);
+    return this.parsedSandboxPolicy;
+  }
   runnerSandbox() {
     if (this.config.runners?.sandbox !== "os" || this.dockerRunners()) return "none";
     this.sandboxUsable ??= osSandboxUsable(this.log);
@@ -13262,7 +13539,8 @@ var CompanionSupervisor = class {
           reportRunnerGone: (report) => this.reportRunnerGone(report),
           connectorHealth: this.connectorHealth,
           locks: this.runnerLocks,
-          sandbox: this.runnerSandbox()
+          sandbox: this.runnerSandbox(),
+          policy: this.sandboxPolicy()
         }
       } : {}
     });
@@ -13959,7 +14237,7 @@ function handleUncaught(log, err, origin) {
 }
 
 // src/crash-marker.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync11, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync13, readFileSync as readFileSync12, rmSync as rmSync12, writeFileSync as writeFileSync9 } from "fs";
 import { join as join20 } from "path";
 function crashMarkerPath() {
   return join20(cabaneDir(), "last-error.json");