@cjhyy/code-shell 0.1.6 → 0.2.0

package/dist/settings/schema.d.ts

@@ -48,38 +48,47 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         provider: string;
         name: string;
+        temperature: number;
         maxTokens: number;
         baseUrl: string;
-        temperature: number;
         apiKey?: string | undefined;
     }, {
         provider?: string | undefined;
         name?: string | undefined;
+        temperature?: number | undefined;
         maxTokens?: number | undefined;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        temperature?: number | undefined;
     }>>;
     providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
         baseUrl: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
         protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
         modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
         modelsPath?: string | undefined;
     }, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
@@ -102,10 +111,18 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodString>;
         apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -117,6 +134,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -129,6 +147,7 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: string | undefined;
         model: string;
         key: string;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -139,6 +158,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -219,16 +239,16 @@ export declare const SettingsSchema: z.ZodObject<{
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }, {
         name: string;
         url?: string | undefined;
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }>>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
@@ -303,6 +323,28 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
     agent: z.ZodDefault<z.ZodObject<{
         preset: z.ZodDefault<z.ZodString>;
@@ -349,38 +391,47 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         provider: string;
         name: string;
+        temperature: number;
         maxTokens: number;
         baseUrl: string;
-        temperature: number;
         apiKey?: string | undefined;
     }, {
         provider?: string | undefined;
         name?: string | undefined;
+        temperature?: number | undefined;
         maxTokens?: number | undefined;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        temperature?: number | undefined;
     }>>;
     providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
         baseUrl: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
         protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
         modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
         modelsPath?: string | undefined;
     }, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
@@ -403,10 +454,18 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodString>;
         apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -418,6 +477,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -430,6 +490,7 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: string | undefined;
         model: string;
         key: string;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -440,6 +501,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -520,16 +582,16 @@ export declare const SettingsSchema: z.ZodObject<{
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }, {
         name: string;
         url?: string | undefined;
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }>>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
@@ -604,6 +666,28 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
     agent: z.ZodDefault<z.ZodObject<{
         preset: z.ZodDefault<z.ZodString>;
@@ -650,38 +734,47 @@ export declare const SettingsSchema: z.ZodObject<{
     }, "strip", z.ZodTypeAny, {
         provider: string;
         name: string;
+        temperature: number;
         maxTokens: number;
         baseUrl: string;
-        temperature: number;
         apiKey?: string | undefined;
     }, {
         provider?: string | undefined;
         name?: string | undefined;
+        temperature?: number | undefined;
         maxTokens?: number | undefined;
         baseUrl?: string | undefined;
         apiKey?: string | undefined;
-        temperature?: number | undefined;
     }>>;
     providers: z.ZodDefault<z.ZodArray<z.ZodObject<{
         key: z.ZodString;
         label: z.ZodOptional<z.ZodString>;
-        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
+        kind: z.ZodEnum<["openai", "anthropic", "deepseek", "zai", "xai", "mistral", "groq", "google", "openrouter", "ollama", "custom"]>;
         baseUrl: z.ZodString;
         apiKey: z.ZodOptional<z.ZodString>;
         protocol: z.ZodOptional<z.ZodEnum<["openai-compat", "anthropic-style"]>>;
         modelsPath: z.ZodOptional<z.ZodString>;
+        /**
+         * DeepSeek V4 thinking-mode default for this provider. "enabled"
+         * matches endpoint default; "disabled" makes V4 calls run in
+         * non-thinking mode (faster, cheaper). Ignored by every provider
+         * other than DeepSeek V4. Per-call overrides still win.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
         modelsPath?: string | undefined;
     }, {
-        kind: "anthropic" | "openai" | "openrouter" | "deepseek" | "ollama" | "mistral" | "custom" | "xai" | "groq" | "google";
+        kind: "anthropic" | "openai" | "deepseek" | "zai" | "xai" | "mistral" | "groq" | "google" | "openrouter" | "ollama" | "custom";
         key: string;
         baseUrl: string;
+        thinking?: "enabled" | "disabled" | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
         protocol?: "openai-compat" | "anthropic-style" | undefined;
@@ -704,10 +797,18 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodString>;
         apiKey: z.ZodOptional<z.ZodString>;
+        /**
+         * Per-model thinking override. Wins over the provider-level
+         * setting (settings.providers[].thinking). Use this when
+         * different models under the same provider need different
+         * defaults — e.g. DeepSeek V4 Pro off (faster) but V4 Flash on.
+         */
+        thinking: z.ZodOptional<z.ZodEnum<["enabled", "disabled"]>>;
     }, "strip", z.ZodTypeAny, {
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -719,6 +820,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -731,6 +833,7 @@ export declare const SettingsSchema: z.ZodObject<{
         provider: string | undefined;
         model: string;
         key: string;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -741,6 +844,7 @@ export declare const SettingsSchema: z.ZodObject<{
         model: string;
         key: string;
         provider?: string | undefined;
+        thinking?: "enabled" | "disabled" | undefined;
         baseUrl?: string | undefined;
         label?: string | undefined;
         apiKey?: string | undefined;
@@ -821,16 +925,16 @@ export declare const SettingsSchema: z.ZodObject<{
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }, {
         name: string;
         url?: string | undefined;
         args?: string[] | undefined;
         headers?: Record<string, string> | undefined;
         command?: string | undefined;
-        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
         env?: Record<string, string> | undefined;
+        transport?: "stdio" | "sse" | "streamable-http" | "inprocess" | undefined;
     }>>>;
     instructions: z.ZodDefault<z.ZodObject<{
         fileName: z.ZodDefault<z.ZodString>;
@@ -905,6 +1009,28 @@ export declare const SettingsSchema: z.ZodObject<{
     }, {
         format?: "text" | "json" | "jsonl" | "stream-json" | undefined;
     }>>;
+    /**
+     * OS-level sandbox for shell-tool execution. "auto" picks per platform:
+     * Seatbelt on macOS, bubblewrap on Linux when installed, otherwise off.
+     * Defaults are applied per Engine run depending on headless vs REPL —
+     * see Engine.run() and run.ts.
+     */
+    sandbox: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<["off", "auto", "seatbelt", "bwrap"]>>;
+        writableRoots: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        deniedReads: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        network: z.ZodOptional<z.ZodEnum<["allow", "deny"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }, {
+        mode?: "auto" | "off" | "seatbelt" | "bwrap" | undefined;
+        writableRoots?: string[] | undefined;
+        deniedReads?: string[] | undefined;
+        network?: "allow" | "deny" | undefined;
+    }>>;
 }, z.ZodTypeAny, "passthrough">>;
 export type ValidatedSettings = z.infer<typeof SettingsSchema>;
 export declare function validateSettings(raw: unknown): ValidatedSettings;

package/dist/tool-summary-V2B3MD5N.js

@@ -0,0 +1,2 @@
+import {b}from'./chunk-ZSAONDT6.js';import {h,a}from'./chunk-3QP5BQ3L.js';h();var p='Generate a very brief (under 40 chars) summary of what these tools did. Use past tense, commit-subject style. Examples: "Read 3 config files", "Fixed import in auth.ts", "Searched for API endpoints". Respond with ONLY the summary text, nothing else.';async function d(r,a,l){if(r.length===0)return null;try{let e=[];for(let t=0;t<r.length;t++){let s=r[t],o=a[t],u=JSON.stringify(s.args).slice(0,200),c=(o?.result??o?.error??"").slice(0,300);e.push(`Tool: ${s.toolName}(${u}) \u2192 ${c}`);}return (await l(p,e.join(`
+`)))?.trim()||null}catch(e){return b.warn("tool_summary.failed",{error:e.message}),null}}a(d,"generateToolUseSummary");export{d as generateToolUseSummary};

package/dist/tool-system/builtin/bash.d.ts

@@ -1,6 +1,12 @@
 /**
  * Built-in Bash shell command execution tool.
+ *
+ * Spawns commands under an optional OS-level sandbox (Seatbelt on macOS,
+ * bubblewrap on Linux). The sandbox is selected by the Engine and handed
+ * down via ToolContext.sandbox. Without a sandbox we fall back to the
+ * historical behavior — plain shell spawn in the user's environment.
  */
+import type { ToolContext } from "../context.js";
 import type { ToolDefinition } from "../../types.js";
 export declare const bashToolDef: ToolDefinition;
-export declare function bashTool(args: Record<string, unknown>): Promise<string>;
+export declare function bashTool(args: Record<string, unknown>, ctx?: ToolContext): Promise<string>;

package/dist/tool-system/context.d.ts

@@ -16,6 +16,7 @@ import type { LLMConfig, StreamCallback } from "../types.js";
 import type { ModelPool } from "../llm/model-pool.js";
 import type { ToolRegistry } from "./registry.js";
 import type { AgentPresetName } from "../preset/index.js";
+import type { SandboxBackend } from "./sandbox/index.js";
 /** One choice in a multiple-choice AskUserQuestion. */
 export interface AskUserChoice {
     label: string;
@@ -86,6 +87,12 @@ export interface ToolContext {
     askUser?: AskUserFn;
     /** Sub-agent spawner (Agent tool). Undefined → Agent tool unavailable. */
     subAgentSpawner?: SubAgentSpawner;
+    /**
+     * Active sandbox backend for the Bash tool. Undefined falls back to "off"
+     * (plain spawn). Headless runs default to an OS-level sandbox; the REPL
+     * defaults to off because a human is in the loop to approve commands.
+     */
+    sandbox?: SandboxBackend;
     /** Optional cancellation signal for the whole turn. */
     signal?: AbortSignal;
 }

package/dist/tool-system/executor.d.ts

@@ -8,6 +8,7 @@ import { PermissionClassifier } from "./permission.js";
 import { logger as rootLogger } from "../logging/logger.js";
 import type { ToolContext } from "./context.js";
 import type { InvestigationGuard } from "./investigation-guard.js";
+import type { TaskGuard } from "./task-guard.js";
 type Logger = typeof rootLogger;
 export declare class ToolExecutor {
     private readonly registry;
@@ -23,9 +24,12 @@ export declare class ToolExecutor {
      */
     private log;
     private guard?;
+    private taskGuard?;
     constructor(registry: ToolRegistry, permission: PermissionClassifier, hooks: HookRegistry);
     setInvestigationGuard(guard: InvestigationGuard | undefined): void;
     getInvestigationGuard(): InvestigationGuard | undefined;
+    setTaskGuard(guard: TaskGuard | undefined): void;
+    getTaskGuard(): TaskGuard | undefined;
     /** Set the abort signal for cascading cancellation. */
     setSignal(signal?: AbortSignal): void;
     /** Set the per-Engine ToolContext (askUser, llmConfig, modelPool, etc.). */

package/dist/tool-system/sandbox/bwrap.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Linux bubblewrap backend.
+ *
+ * bwrap creates a fresh mount namespace, then bind-mounts only what we tell
+ * it. We bind / read-only and overlay writableRoots as read-write. PID,
+ * IPC, UTS, cgroup namespaces are unshared. Network is shared unless
+ * config.network === "deny".
+ *
+ * Sensitive directories listed in deniedReads are shadowed with a tmpfs so
+ * the inner process literally cannot see them even though `/` is mounted.
+ */
+import type { SandboxBackend, SandboxConfig } from "./index.js";
+export declare function createBwrapBackend(config: SandboxConfig): SandboxBackend;

package/dist/tool-system/sandbox/index.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Sandbox backends for shell command execution.
+ *
+ * We wrap Bash-tool commands in an OS-level sandbox so a misbehaving (or
+ * prompt-injected) model can't reach beyond the workspace. The sandbox runs
+ * the user's command inside an isolated process tree with restricted file
+ * and (optionally) network access. The Engine itself is NOT sandboxed; only
+ * the spawned shell is. File-editing tools (Edit/Write) keep going through
+ * the application-layer permission gate.
+ *
+ * Backends are platform-specific:
+ *   - "seatbelt"  macOS sandbox-exec, built into macOS, zero install
+ *   - "bwrap"     Linux bubblewrap, requires `apt install bubblewrap`
+ *   - "off"       passthrough, no sandboxing (current behavior)
+ *
+ * "auto" picks per platform at startup; falls back to "off" with a warning
+ * when no sandbox is available.
+ */
+export type SandboxMode = "off" | "auto" | "seatbelt" | "bwrap";
+export type SandboxNetworkPolicy = "allow" | "deny";
+export interface SandboxConfig {
+    mode: SandboxMode;
+    writableRoots: string[];
+    deniedReads: string[];
+    network: SandboxNetworkPolicy;
+}
+export interface SandboxBackend {
+    /** Resolved backend name — "off" means no sandboxing. */
+    name: "off" | "seatbelt" | "bwrap";
+    /**
+     * Decide the binary + argv that should actually be spawned to run `command`
+     * under this sandbox. The shell still interprets `command`; we only swap
+     * the outer process.
+     */
+    wrap(command: string, opts: {
+        cwd: string;
+        shell: string;
+    }): {
+        file: string;
+        args: string[];
+        /**
+         * Optional callback the Bash tool calls after the child process exits.
+         * Backends that allocate per-command resources (e.g. seatbelt writes a
+         * profile file to a fresh temp dir) hang their cleanup here so a long
+         * session doesn't leak hundreds of temp dirs in /tmp.
+         */
+        cleanup?: () => void;
+    };
+    /**
+     * If `stderr` looks like a sandbox denial, return a short hint string that
+     * the Bash tool will append to its result so the model understands why.
+     */
+    hintForBlockedOutput?(stderr: string): string | undefined;
+}
+/**
+ * Detect which sandbox mechanisms are available on the current host. Used by
+ * "auto" mode and surfaced to the user via /sandbox status if desired.
+ */
+export declare function detectSandboxCapabilities(): {
+    seatbelt: boolean;
+    bwrap: boolean;
+};
+/**
+ * Expand `~` and `${workspace}` placeholders against the live cwd and home.
+ */
+export declare function expandPath(p: string, cwd: string): string;
+export declare function expandConfig(config: SandboxConfig, cwd: string): SandboxConfig;
+export declare function defaultSandboxConfig(mode?: SandboxMode): SandboxConfig;
+/**
+ * Resolve the active backend given user config + the current host.
+ *
+ *   "off"      → off backend
+ *   "seatbelt" → seatbelt if available, else throws (explicit choice)
+ *   "bwrap"    → bwrap if available, else throws
+ *   "auto"     → seatbelt on macOS, bwrap on Linux with bwrap installed,
+ *                else off + console warning
+ */
+export declare function resolveSandboxBackend(config: SandboxConfig, cwd: string): Promise<SandboxBackend>;

package/dist/tool-system/sandbox/off.d.ts

@@ -0,0 +1,2 @@
+import type { SandboxBackend } from "./index.js";
+export declare function createOffBackend(): SandboxBackend;

package/dist/tool-system/sandbox/seatbelt.d.ts

@@ -0,0 +1,18 @@
+/**
+ * macOS Seatbelt backend.
+ *
+ * Builds a sandbox-exec profile that:
+ *   - Allows reading most of the filesystem (denying everything breaks tooling)
+ *   - Denies reads of sensitive credential directories
+ *   - Restricts writes to the workspace + writableRoots
+ *   - Optionally denies outbound network
+ *
+ * The profile is written to a fresh temp file per command (cheap; users can
+ * have arbitrary writableRoots so we can't cache). The spawned process and
+ * its entire subprocess tree inherit the profile via XNU's sandbox framework.
+ *
+ * sandbox-exec is technically deprecated by Apple but remains the only
+ * working OS-level sandbox on macOS and is what Codex CLI / Cursor use today.
+ */
+import type { SandboxBackend, SandboxConfig } from "./index.js";
+export declare function createSeatbeltBackend(config: SandboxConfig): SandboxBackend;

package/dist/tool-system/task-guard.d.ts

@@ -0,0 +1,30 @@
+/**
+ * TaskGuard — nudges the model to update stale in_progress tasks.
+ *
+ * Background: TaskCreate is sticky in the model's working memory only for the
+ * first few turns. After enough intervening tool_results (Read/Edit/Bash) the
+ * "I have an open task" signal gets diluted and the model finishes its work
+ * without ever calling TaskUpdate(status="completed") — so the UI spinner runs
+ * forever on a task that the model considers done.
+ *
+ * Same shape as InvestigationGuard.turnEnded: turn-loop polls at the end of
+ * each turn; if anything is in_progress and hasn't been touched in N turns,
+ * we emit a <system-reminder> that lands at the top of the next turn.
+ *
+ * Re-nag policy: don't fire more than once per (task, threshold) pair. A task
+ * stale at turn 5 fires once; if the model still ignores it, we wait for it
+ * to cross the next threshold (8, 11, …) before firing again. This keeps the
+ * reminder from drowning out everything else when the model is genuinely
+ * stuck on something unrelated.
+ */
+import type { Task } from "./builtin/task.js";
+export declare class TaskGuard {
+    private taskListSource;
+    /** Last turn we nagged about a given task id. */
+    private lastNagTurn;
+    /** Turn the task was first observed in_progress (model-time, not wall-clock). */
+    private inProgressSince;
+    constructor(taskListSource: () => Task[]);
+    turnEnded(turnNumber: number): string | undefined;
+    reset(): void;
+}