@f5-sales-demo/xcsh 20.0.5 → 20.1.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## [Unreleased]
 
+## [20.1.1] - 2026-08-01
+
+### Fixed
+
+- Made `xcsh sandbox check` exercise the live bash profile, report actionable failure details, and run under macOS and Linux confinement in CI ([#2800](https://github.com/f5-sales-demo/xcsh/issues/2800))
+
+## [20.1.0] - 2026-08-01
+
+### Added
+
+- Added `xcsh sandbox check` to verify the installed sandbox with synthetic fixtures and automatic cleanup ([#2790](https://github.com/f5-sales-demo/xcsh/issues/2790))
+
+### Fixed
+
+- Denied local account containers and other operators' homes while preserving full access to the current operator's home ([#2788](https://github.com/f5-sales-demo/xcsh/issues/2788))
+
 ## [20.0.4] - 2026-08-01
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.0.5",
+	"version": "20.1.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.0.5",
-		"@f5-sales-demo/pi-agent-core": "20.0.5",
-		"@f5-sales-demo/pi-ai": "20.0.5",
-		"@f5-sales-demo/pi-natives": "20.0.5",
-		"@f5-sales-demo/pi-resource-management": "20.0.5",
-		"@f5-sales-demo/pi-tui": "20.0.5",
-		"@f5-sales-demo/pi-utils": "20.0.5",
+		"@f5-sales-demo/xcsh-stats": "20.1.1",
+		"@f5-sales-demo/pi-agent-core": "20.1.1",
+		"@f5-sales-demo/pi-ai": "20.1.1",
+		"@f5-sales-demo/pi-natives": "20.1.1",
+		"@f5-sales-demo/pi-resource-management": "20.1.1",
+		"@f5-sales-demo/pi-tui": "20.1.1",
+		"@f5-sales-demo/pi-utils": "20.1.1",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/sandbox-check.ts

@@ -0,0 +1,542 @@
+/** Installed-binary conformance check for the live filesystem sandbox. */
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { executeShell } from "@f5-sales-demo/pi-natives";
+import { isEnoent } from "@f5-sales-demo/pi-utils";
+import { Settings } from "../config/settings";
+import { fenceForNative } from "../exec/bash-executor";
+import { buildContainmentFence, type ContainmentFence, containmentStatus } from "../sandbox/containment";
+import { evaluateToolCall } from "../sandbox/enforce";
+import { SANDBOX_OPERATOR_HOME_ENV, SANDBOX_SESSION_ROOT_ENV } from "../sandbox/session-fence";
+import { BashTool, type ToolSession } from "../tools";
+
+export type SandboxCheckResultStatus = "PASS" | "FAIL" | "SKIP";
+
+export interface SandboxCheckResult {
+	name: string;
+	status: SandboxCheckResultStatus;
+	/** Present on failures and skips; paths are generalized before they leave the process. */
+	detail?: string;
+}
+
+export interface SandboxCheckReport {
+	backend: string;
+	osEnforced: boolean;
+	checks: SandboxCheckResult[];
+	summary: {
+		passed: number;
+		failed: number;
+		skipped: number;
+	};
+}
+
+export interface SandboxCheckOptions {
+	json?: boolean;
+	verbose?: boolean;
+}
+
+interface ProbeOutcome {
+	passed: boolean;
+	detail?: string;
+}
+
+interface ShellProbeResult {
+	exitCode: number;
+	output: string;
+}
+
+type Redaction = readonly [path: string, label: string];
+
+function quote(value: string): string {
+	return JSON.stringify(value);
+}
+
+function errorCode(error: unknown): string | undefined {
+	if (typeof error !== "object" || error === null || !("code" in error)) return undefined;
+	const code = (error as { code?: unknown }).code;
+	return typeof code === "string" ? code : undefined;
+}
+
+function sanitizeDetail(value: string, redactions: readonly Redaction[]): string {
+	let sanitized = value;
+	for (const [actual, label] of [...redactions].sort(([a], [b]) => b.length - a.length)) {
+		if (actual.length > 0) sanitized = sanitized.replaceAll(actual, label);
+	}
+	sanitized = sanitized.replace(/\s+/gu, " ").trim();
+	return sanitized.length > 500 ? `${sanitized.slice(0, 497)}...` : sanitized;
+}
+
+function errnoFromOutput(output: string): string {
+	if (/operation not permitted/iu.test(output)) return "EPERM";
+	if (/permission denied/iu.test(output)) return "EACCES";
+	if (/no such file or directory/iu.test(output)) return "ENOENT";
+	if (/not a directory/iu.test(output)) return "ENOTDIR";
+	return "unknown";
+}
+
+function exceptionOutcome(
+	assertion: string,
+	displayPath: string,
+	error: unknown,
+	redactions: readonly Redaction[],
+): ProbeOutcome {
+	const message = error instanceof Error ? error.message : String(error);
+	return {
+		passed: false,
+		detail: sanitizeDetail(
+			`${assertion}; path=${displayPath}; errno=${errorCode(error) ?? "unknown"}; error=${message}`,
+			redactions,
+		),
+	};
+}
+
+function shellOutcome(
+	result: ShellProbeResult,
+	expectSuccess: boolean,
+	assertion: string,
+	displayPath: string,
+	redactions: readonly Redaction[],
+): ProbeOutcome {
+	const passed = expectSuccess ? result.exitCode === 0 : result.exitCode !== 0;
+	if (passed) return { passed: true };
+	const output = sanitizeDetail(result.output, redactions);
+	const errno = result.exitCode === 0 ? "none" : errnoFromOutput(output);
+	return {
+		passed: false,
+		detail: sanitizeDetail(
+			`${assertion}; path=${displayPath}; exit=${result.exitCode}; errno=${errno}${output ? `; output=${output}` : ""}`,
+			redactions,
+		),
+	};
+}
+
+async function shellProbe(
+	command: string,
+	cwd: string,
+	fence: ContainmentFence | undefined,
+	signal: AbortSignal,
+): Promise<ShellProbeResult> {
+	let output = "";
+	const result = await executeShell(
+		{
+			command,
+			cwd,
+			fence: fence === undefined ? undefined : fenceForNative(fence),
+			signal,
+			timeoutMs: 15_000,
+		},
+		(error, chunk) => {
+			if (error) output += `${error.message}\n`;
+			else output += chunk;
+		},
+	);
+	return { exitCode: result.exitCode ?? -1, output };
+}
+
+function renderReport(report: SandboxCheckReport, json: boolean, verbose: boolean): void {
+	if (json) {
+		process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+		return;
+	}
+
+	const enforcement = report.osEnforced ? "OS enforced" : "scanner only";
+	process.stdout.write(`Sandbox backend: ${report.backend} (${enforcement})\n\n`);
+	const width = Math.max(0, ...report.checks.map(check => check.name.length));
+	for (const check of report.checks) {
+		process.stdout.write(`${check.status.padEnd(4)}  ${check.name.padEnd(width)}\n`);
+		if (verbose && check.detail) process.stdout.write(`      ${check.detail}\n`);
+	}
+	process.stdout.write(
+		`\n${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.skipped} skipped\n`,
+	);
+	if (!verbose && report.summary.failed > 0) {
+		process.stdout.write("Run `xcsh sandbox check --verbose` for failure details.\n");
+	}
+}
+
+/** Run the conformance matrix and report only after every synthetic fixture has been removed. */
+export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promise<SandboxCheckReport> {
+	const backend = containmentStatus(true);
+	const checks: SandboxCheckResult[] = [];
+	const fixturePaths: string[] = [];
+	const knownCleanupLeaves: string[] = [];
+	const nonEnumerableCleanupDirs = new Set<string>();
+	const redactions: Redaction[] = [];
+	const abortController = new AbortController();
+	const interrupt = () => abortController.abort();
+	process.once("SIGINT", interrupt);
+	process.once("SIGTERM", interrupt);
+
+	let fixtureRoot: string | undefined;
+	const add = (name: string, status: SandboxCheckResultStatus, detail?: string): void => {
+		checks.push({ name, status, ...(detail ? { detail } : {}) });
+	};
+	const check = async (
+		name: string,
+		probe: () => boolean | ProbeOutcome | Promise<boolean | ProbeOutcome>,
+	): Promise<void> => {
+		if (abortController.signal.aborted) {
+			add(name, "FAIL", "probe aborted before execution; path=<probe>; errno=ABORTED");
+			return;
+		}
+		try {
+			const result = await probe();
+			const outcome = typeof result === "boolean" ? { passed: result } : result;
+			add(
+				name,
+				outcome.passed ? "PASS" : "FAIL",
+				outcome.passed ? undefined : (outcome.detail ?? "assertion failed; path=<probe>; errno=unknown"),
+			);
+		} catch (error) {
+			const outcome = exceptionOutcome("probe threw", "<probe>", error, redactions);
+			add(name, "FAIL", outcome.detail);
+		}
+	};
+
+	try {
+		const inheritedProfile = process.env[SANDBOX_SESSION_ROOT_ENV] !== undefined;
+		const workspaceInput = process.env[SANDBOX_SESSION_ROOT_ENV] ?? process.cwd();
+		const homeInput = process.env[SANDBOX_OPERATOR_HOME_ENV] ?? os.homedir();
+		redactions.push([workspaceInput, "<workspace>"], [homeInput, "<operator-home>"]);
+		const liveWorkspace = await fs.realpath(workspaceInput);
+		const liveHome = await fs.realpath(homeInput);
+		redactions.push([liveWorkspace, "<workspace>"], [liveHome, "<operator-home>"]);
+
+		const fixtureBase = inheritedProfile ? liveWorkspace : await fs.realpath(os.tmpdir());
+		fixtureRoot = await fs.mkdtemp(path.join(fixtureBase, ".xcsh-sandbox-check-policy-"));
+		fixturePaths.push(fixtureRoot);
+		redactions.push([fixtureRoot, "<synthetic-root>"]);
+
+		const accountRoot = path.join(fixtureRoot, "Users");
+		const operatorHome = path.join(accountRoot, "operator");
+		const otherHome = path.join(accountRoot, "other-account");
+		const workspaces = path.join(operatorHome, "workspaces");
+		const workspace = path.join(workspaces, "example-a");
+		const sibling = path.join(workspaces, "example-b");
+		const nested = path.join(workspace, "nested");
+		const sessionStore = path.join(operatorHome, ".xcsh", "agent", "sessions");
+		const otherSession = path.join(sessionStore, "synthetic-session");
+		const memoryStore = path.join(operatorHome, ".xcsh", "agent", "memories");
+		const otherMemory = path.join(memoryStore, "synthetic-memory");
+		const configDir = path.join(operatorHome, ".config", "xcsh-check");
+
+		for (const dir of [workspace, sibling, nested, otherHome, otherSession, otherMemory, configDir]) {
+			await fs.mkdir(dir, { recursive: true });
+		}
+		await Bun.write(path.join(workspace, "own.txt"), "own\n");
+		await Bun.write(path.join(sibling, "named.txt"), "sibling\n");
+		await Bun.write(path.join(otherHome, "synthetic.txt"), "synthetic\n");
+		await Bun.write(path.join(otherSession, "state.jsonl"), "synthetic\n");
+		await Bun.write(path.join(otherMemory, "MEMORY.md"), "synthetic\n");
+
+		const fence = buildContainmentFence({
+			workspace,
+			home: operatorHome,
+			fsRoot: fixtureRoot,
+			leakRoots: [sessionStore, memoryStore],
+		});
+
+		await check("structured tools share the boundary", () => {
+			const blocked = [
+				evaluateToolCall({ toolName: "read", input: { file_path: workspaces }, cwd: workspace, fence }),
+				evaluateToolCall({
+					toolName: "write",
+					input: { file_path: path.join(otherHome, "new.txt") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({ toolName: "find", input: { pattern: `${accountRoot}/**/*` }, cwd: workspace, fence }),
+				evaluateToolCall({ toolName: "grep", input: { path: otherHome }, cwd: workspace, fence }),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherSession, "state.jsonl") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "read",
+					input: { file_path: path.join(otherMemory, "MEMORY.md") },
+					cwd: workspace,
+					fence,
+				}),
+				evaluateToolCall({
+					toolName: "python",
+					input: { code: `import os; os.listdir(${JSON.stringify(accountRoot)})` },
+					cwd: workspace,
+					fence,
+				}),
+			];
+			const ownConfig = evaluateToolCall({
+				toolName: "write",
+				input: { file_path: path.join(configDir, "config") },
+				cwd: workspace,
+				fence,
+			});
+			const passed = blocked.every(result => result.block) && !ownConfig.block;
+			return passed
+				? { passed: true }
+				: {
+						passed: false,
+						detail: "structured-tool policy disagreed with the shell boundary; path=<synthetic-root>; errno=none",
+					};
+		});
+
+		await check("workspace read, write, glob, and recursion", async () => {
+			const displayPath = "<workspace>/<synthetic-fixture>";
+			let liveFixture: string;
+			try {
+				liveFixture = await fs.mkdtemp(path.join(liveWorkspace, ".xcsh-sandbox-check-workspace-"));
+				fixturePaths.push(liveFixture);
+				redactions.push([liveFixture, displayPath]);
+				await fs.mkdir(path.join(liveFixture, "nested"));
+				await Bun.write(path.join(liveFixture, "own.txt"), "own\n");
+			} catch (error) {
+				return exceptionOutcome("create live workspace fixture", displayPath, error, redactions);
+			}
+			const command =
+				"cat own.txt > /dev/null && printf created > created.txt && " +
+				"printf '%s\\n' ./* > /dev/null && find . -type f > /dev/null";
+			const result = await shellProbe(command, liveFixture, undefined, abortController.signal);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must allow workspace read, write, glob, and recursion",
+				displayPath,
+				redactions,
+			);
+		});
+
+		await check("named sibling remains reachable", async () => {
+			const displayPath = "<session-parent>/<synthetic-sibling>";
+			let liveSibling: string;
+			try {
+				liveSibling = await fs.mkdtemp(path.join(path.dirname(liveWorkspace), ".xcsh-sandbox-check-sibling-"));
+				fixturePaths.push(liveSibling);
+				nonEnumerableCleanupDirs.add(liveSibling);
+				redactions.push([liveSibling, displayPath]);
+				const namedFile = path.join(liveSibling, "named.txt");
+				await Bun.write(namedFile, "sibling\n");
+				knownCleanupLeaves.push(namedFile);
+			} catch (error) {
+				return exceptionOutcome("create named sibling fixture", displayPath, error, redactions);
+			}
+			const result = await shellProbe(
+				'test "$(cat named.txt)" = sibling',
+				liveSibling,
+				undefined,
+				abortController.signal,
+			);
+			return shellOutcome(result, true, "live profile must allow a named sibling read", displayPath, redactions);
+		});
+
+		if (backend.osEnforced) {
+			await check("session parent cannot be enumerated", async () => {
+				const result = await shellProbe(
+					`ls ${quote(workspaces)} > /dev/null`,
+					workspace,
+					fence,
+					abortController.signal,
+				);
+				return shellOutcome(
+					result,
+					false,
+					"synthetic session parent enumeration must be refused",
+					"<synthetic-session-parent>",
+					redactions,
+				);
+			});
+			await check("account container cannot be enumerated", async () => {
+				const result = await shellProbe(
+					`ls ${quote(accountRoot)} > /dev/null`,
+					workspace,
+					fence,
+					abortController.signal,
+				);
+				return shellOutcome(
+					result,
+					false,
+					"synthetic account container enumeration must be refused",
+					"<synthetic-account-container>",
+					redactions,
+				);
+			});
+			await check("synthetic other account cannot be entered", async () => {
+				const result = await shellProbe(`cd ${quote(otherHome)}`, workspace, fence, abortController.signal);
+				return shellOutcome(
+					result,
+					false,
+					"synthetic other account traversal must be refused",
+					"<synthetic-other-account>",
+					redactions,
+				);
+			});
+			await check("cross-session stores cannot be read", async () => {
+				const sessionRead = await shellProbe(
+					`cat ${quote(path.join(otherSession, "state.jsonl"))} > /dev/null`,
+					workspace,
+					fence,
+					abortController.signal,
+				);
+				const sessionOutcome = shellOutcome(
+					sessionRead,
+					false,
+					"synthetic other session read must be refused",
+					"<synthetic-session-store>/<synthetic-session>",
+					redactions,
+				);
+				if (!sessionOutcome.passed) return sessionOutcome;
+
+				const memoryRead = await shellProbe(
+					`cat ${quote(path.join(otherMemory, "MEMORY.md"))} > /dev/null`,
+					workspace,
+					fence,
+					abortController.signal,
+				);
+				return shellOutcome(
+					memoryRead,
+					false,
+					"synthetic other memory read must be refused",
+					"<synthetic-memory-store>/<synthetic-memory>",
+					redactions,
+				);
+			});
+		} else {
+			for (const name of [
+				"session parent cannot be enumerated",
+				"account container cannot be enumerated",
+				"synthetic other account cannot be entered",
+				"cross-session stores cannot be read",
+			]) {
+				add(name, "SKIP", "OS enforcement backend unavailable; path=<probe>; errno=unsupported");
+			}
+		}
+
+		await check("operator home configuration is writable", async () => {
+			const displayPath = "<operator-home>/<synthetic-fixture>";
+			let liveConfig: string;
+			try {
+				// Landlock cannot grant creation on a split directory without also granting every
+				// denied descendant. The live fence therefore grants operator-owned CLI config roots
+				// explicitly; use one of those when another Landlock profile is already inherited.
+				// Standalone and Seatbelt checks retain the direct-home probe.
+				const configBase =
+					inheritedProfile && backend.backend === "landlock" ? path.join(liveHome, ".config", "gh") : liveHome;
+				liveConfig = await fs.mkdtemp(path.join(configBase, ".xcsh-sandbox-check-home-"));
+				fixturePaths.push(liveConfig);
+				redactions.push([liveConfig, displayPath]);
+			} catch (error) {
+				return exceptionOutcome("create operator-home fixture", displayPath, error, redactions);
+			}
+			const result = await shellProbe(
+				'printf operator > config && test "$(cat config)" = operator',
+				liveConfig,
+				undefined,
+				abortController.signal,
+			);
+			return shellOutcome(
+				result,
+				true,
+				"live profile must allow operator-home configuration writes",
+				displayPath,
+				redactions,
+			);
+		});
+
+		await check("cwd resets across tool calls", async () => {
+			const settings = await Settings.init({
+				cwd: workspace,
+				agentDir: path.join(fixtureRoot!, "agent-state"),
+				inMemory: true,
+				overrides: {
+					"async.enabled": false,
+					"bash.autoBackground.enabled": false,
+					"bashInterceptor.enabled": false,
+					"sandbox.enabled": true,
+				},
+			});
+			const session: ToolSession = {
+				cwd: workspace,
+				hasUI: false,
+				hasEditTool: true,
+				settings,
+				getSessionFile: () => null,
+				getSessionSpawns: () => null,
+				getSessionId: () => "sandbox-check-session",
+			};
+			const tool = new BashTool(session);
+			const moved = await tool.execute("sandbox-check-move", { command: `cd ${quote(nested)}; pwd` });
+			const reset = await tool.execute("sandbox-check-reset", { command: "pwd" });
+			const explicit = await tool.execute("sandbox-check-explicit", { command: "pwd", cwd: nested });
+			const text = (result: typeof moved): string =>
+				result.content
+					.filter((part): part is { type: "text"; text: string } => part.type === "text")
+					.map(part => part.text)
+					.join("")
+					.trim();
+			const passed = text(moved) === nested && text(reset) === workspace && text(explicit) === nested;
+			return passed
+				? { passed: true }
+				: {
+						passed: false,
+						detail:
+							"tool-call cwd did not reset to <synthetic-workspace> or honor explicit cwd; path=<synthetic-root>; errno=none",
+					};
+		});
+	} catch (error) {
+		const outcome = exceptionOutcome("conformance matrix setup failed", "<probe>", error, redactions);
+		add("conformance matrix completed", "FAIL", outcome.detail);
+	} finally {
+		process.off("SIGINT", interrupt);
+		process.off("SIGTERM", interrupt);
+		const cleanupFailures: string[] = [];
+		for (const leafPath of [...knownCleanupLeaves].reverse()) {
+			try {
+				await fs.rm(leafPath, { force: true });
+			} catch (error) {
+				if (!isEnoent(error)) cleanupFailures.push(error instanceof Error ? error.message : String(error));
+			}
+		}
+		for (const fixturePath of [...fixturePaths].reverse()) {
+			try {
+				// Landlock denies enumeration of the session parent. A sibling created after the
+				// profile snapshot consequently cannot be walked during recursive cleanup, even
+				// though its known leaf and the directory itself can be removed by name.
+				if (nonEnumerableCleanupDirs.has(fixturePath)) await fs.rmdir(fixturePath);
+				else await fs.rm(fixturePath, { recursive: true, force: true });
+				await fs.stat(fixturePath);
+				cleanupFailures.push(`fixture remains at ${fixturePath}`);
+			} catch (error) {
+				if (!isEnoent(error)) cleanupFailures.push(error instanceof Error ? error.message : String(error));
+			}
+		}
+
+		if (fixtureRoot === undefined || cleanupFailures.length > 0) {
+			add(
+				"synthetic fixtures removed",
+				"FAIL",
+				sanitizeDetail(
+					`fixture cleanup incomplete; path=<synthetic-fixtures>; errno=${
+						fixtureRoot === undefined ? "ENOENT" : "unknown"
+					}${cleanupFailures.length > 0 ? `; error=${cleanupFailures.join("; ")}` : ""}`,
+					redactions,
+				),
+			);
+		} else {
+			add("synthetic fixtures removed", "PASS");
+		}
+	}
+
+	const report: SandboxCheckReport = {
+		backend: backend.backend,
+		osEnforced: backend.osEnforced,
+		checks,
+		summary: {
+			passed: checks.filter(result => result.status === "PASS").length,
+			failed: checks.filter(result => result.status === "FAIL").length,
+			skipped: checks.filter(result => result.status === "SKIP").length,
+		},
+	};
+	renderReport(report, options.json ?? false, options.verbose ?? false);
+	return report;
+}

package/src/cli.ts

@@ -56,6 +56,7 @@ const commands: CommandEntry[] = [
 	{ name: "grep", load: () => import("./commands/grep").then(m => m.default) },
 	{ name: "grievances", load: () => import("./commands/grievances").then(m => m.default) },
 	{ name: "read", load: () => import("./commands/read").then(m => m.default) },
+	{ name: "sandbox", load: () => import("./commands/sandbox").then(m => m.default) },
 	{ name: "jupyter", load: () => import("./commands/jupyter").then(m => m.default) },
 	{ name: "manager", load: () => import("./commands/manager").then(m => m.default) },
 	{ name: "office", load: () => import("./commands/office").then(m => m.default) },

package/src/commands/sandbox.ts

@@ -0,0 +1,26 @@
+/** Run installed-binary sandbox diagnostics. */
+import { Args, Command, Flags } from "@f5-sales-demo/pi-utils/cli";
+import { runSandboxCheck } from "../cli/sandbox-check";
+
+export default class Sandbox extends Command {
+	static description = "Verify the installed filesystem sandbox";
+
+	static args = {
+		action: Args.string({
+			description: "Sandbox action",
+			required: true,
+			options: ["check"],
+		}),
+	};
+
+	static flags = {
+		json: Flags.boolean({ description: "Output JSON" }),
+		verbose: Flags.boolean({ char: "v", description: "Show failure details" }),
+	};
+
+	async run(): Promise<void> {
+		const { flags } = await this.parse(Sandbox);
+		const report = await runSandboxCheck({ json: flags.json, verbose: flags.verbose });
+		if (report.summary.failed > 0) process.exitCode = 1;
+	}
+}

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.0.5",
-	"commit": "7c158ece9fb627b0019556510b360217eb067b7b",
-	"shortCommit": "7c158ec",
+	"version": "20.1.1",
+	"commit": "ac536e6d319a00467e8e95de237cc915b1551dec",
+	"shortCommit": "ac536e6",
 	"branch": "main",
-	"tag": "v20.0.5",
-	"commitDate": "2026-08-01T10:05:07Z",
-	"buildDate": "2026-08-01T10:26:03.896Z",
+	"tag": "v20.1.1",
+	"commitDate": "2026-08-01T18:06:22Z",
+	"buildDate": "2026-08-01T18:28:19.612Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/7c158ece9fb627b0019556510b360217eb067b7b",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.0.5"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ac536e6d319a00467e8e95de237cc915b1551dec",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.1.1"
 };

package/src/prompts/internal-urls/containment.md

@@ -15,9 +15,9 @@ followed symlinks — so how a path is spelled does not change what is reachable
 - Cross-tenant isolation removes the discovery step. The directory containing the session root cannot
   be enumerated, but a sibling path the operator names directly can still be read, written, or entered.
   An explicit read grant, including `--allow-path <dir>`, restores enumeration for that directory.
-- Cross-session stores and data roots remain denied. Another session's transcripts, memories, internal
-  contexts, and temporary working state are not reachable through tools, nor are unrelated data roots
-  and mounted data volumes.
+- Cross-session stores, other operators' accounts, and data roots remain denied. Another session's
+  transcripts, memories, internal contexts, and temporary working state are not reachable through
+  tools, nor are sibling local accounts, unrelated data roots, and mounted data volumes.
 
 The same boundary answers for every tool. `read`, `write`, `grep`, `find`, `python`, and `bash` consult
 the same rules, so changing tools or spelling a path differently does not widen the session.
@@ -51,7 +51,8 @@ spelling may not be caught.
 
 The intended rules are the same ones a confined session has: parent enumeration is refused while named
 operator access remains available, operator-owned home and configuration stay readable and writable,
-and cross-session stores and unrelated data roots stay denied. Ordinary work remains unrestricted.
+and cross-session stores, other operators' accounts, and unrelated data roots stay denied. Ordinary
+work remains unrestricted.
 
 Treat the boundary as a statement of intent rather than a guarantee, and do not go looking for paths
 outside the session directory on the assumption that something would stop you.

package/src/sandbox/containment.ts

@@ -8,8 +8,8 @@
  *
  * So the fence is gentle. It leaves `/usr`, `/tmp`, package caches, the network and process execution
  * alone. Its cross-tenant courtesy removes the discovery step — enumerating the session root's parent —
- * while keeping named operator access. Explicit data-root and cross-session state denies remain where
- * the model has no legitimate reason to wander (#2554).
+ * while keeping named operator access. Other operators' accounts, explicit data roots and cross-session
+ * state remain denied where the model has no legitimate reason to wander (#2554).
  *
  * Produced declaratively rather than as an ordered rule list, because the two backends disagree about
  * order: seatbelt evaluates rules in sequence with the last match winning, while Landlock only grants
@@ -197,9 +197,8 @@ const OPERATIONAL_ROOT_NAMES = new Set([
  * unforeseen — `/data`, `/scratch`, a bespoke mount.
  */
 const DATA_ROOTS = [
-	// `/Users` and `/home` are deliberately absent: denying the home container denies this operator's own
-	// home with it, which is the whole of #2637. Other accounts are 0700, so the filesystem already refuses
-	// them; the fence is not here to re-implement file permissions.
+	"/Users", // Account containers are denied, then this operator's canonical home is allowed back at
+	"/home", // greater depth. That preserves #2637 without exposing another local account (#2788).
 	"/root", // Linux superuser home: not this operator's account
 	"/Volumes", // macOS mounts. Per-container, not per-child: /Volumes/Macintosh HD resolves to /,
 	"/mnt", // which `tooBroadToDeny` then rejects, and the kernel resolves such a path before any
@@ -481,6 +480,11 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	}
 
 	if (home !== undefined) {
+		// The account container is a data root, but this operator's whole home belongs to them (#2637).
+		// A deeper full allow preserves their normal filesystem rights while leaving sibling accounts under
+		// the broader deny. Cross-session stores are denied again at still greater depth below.
+		allow.add(home);
+
 		// Granted whether or not they exist yet. `~/.bun` has to be writable *before* the first
 		// `bun install` creates it, so dropping absent caches would break exactly the first run.
 		// Canonicalised when present, so a symlinked cache resolves to its real location.
@@ -505,6 +509,7 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 	// prefix whether or not the path exists; Landlock cannot attach a rule to an absent inode, but its
 	// plan never grants a path `readdir` did not see either, so nothing is lost there.
 	const known = DATA_ROOTS.map(name => canonicalThroughExisting(path.join(fsRoot, path.basename(name))));
+	const accountRoots = new Set(["Users", "home"].map(name => canonicalThroughExisting(path.join(fsRoot, name))));
 	const found = dataRootEntries(fsRoot).map(entry => canonical(entry) ?? entry);
 	// Whole filesystem roots other than the workspace's own — the other Windows drives.
 	//
@@ -520,11 +525,11 @@ export function buildContainmentFence(options: ContainmentOptions): ContainmentF
 		// e.g. /Volumes/Macintosh HD -> /. Skipped for the whole-root list, per the note above.
 		if (!rootScoped.has(resolved) && tooBroadToDeny(resolved, fsRoot)) continue;
 		if (resolved === fsRoot) continue; // never the root the workspace lives on
-		// Never a directory that CONTAINS home, because denying it denies home (#2637). Removing `/Users`
-		// and `/home` from the static list was not enough: the root enumeration re-adds them, since
-		// `Users` is not an operational name. That is what still refused `~/git/STYLE_GUIDE.md` at the
-		// kernel while `fenceVerdict` said allow — the unit tests use synthetic roots and could not see it.
-		if (home !== undefined && pathIsWithin(resolved, home)) continue;
+		// A directory containing home is normally too broad to deny because it would revoke the operator's
+		// own files (#2637). Account containers are the deliberate exception: they are denied here and the
+		// canonical home allow above wins at greater depth, isolating sibling accounts without hobbling the
+		// operator (#2788).
+		if (home !== undefined && pathIsWithin(resolved, home) && !accountRoots.has(resolved)) continue;
 		// A deny beats an allow at EQUAL depth, so denying a root that IS the workspace or IS something
 		// the operator granted would not be redundant — it would silently revoke the grant. Deeper is
 		// fine and intended: an ancestor deny with the workspace allowed inside it is the normal shape.

package/src/sandbox/session-fence.ts

@@ -16,6 +16,17 @@
  */
 import { buildContainmentFence, type ContainmentFence } from "./containment";
 
+/**
+ * Trusted context added to commands launched by the fenced model bash tool.
+ *
+ * A subprocess cannot infer the session anchor after a command-local `cd`, and an inherited OS
+ * sandbox cannot be loosened. The installed sandbox diagnostic uses these values to place its
+ * allow-side fixtures inside paths the live bash profile already grants instead of inventing a
+ * second workspace under the system temp directory (#2800).
+ */
+export const SANDBOX_SESSION_ROOT_ENV = "XCSH_SANDBOX_SESSION_ROOT";
+export const SANDBOX_OPERATOR_HOME_ENV = "XCSH_SANDBOX_OPERATOR_HOME";
+
 /** The slice of `Settings` this needs — supplied explicitly so the caller names its own source. */
 export interface SettingsReader {
 	get(key: string): unknown;

package/src/tools/bash.ts

@@ -1,4 +1,5 @@
 import * as fs from "node:fs";
+import * as os from "node:os";
 import type {
 	AgentTool,
 	AgentToolContext,
@@ -17,7 +18,7 @@ import { truncateToVisualLines } from "../modes/components/visual-truncate";
 import type { Theme } from "../modes/theme/theme";
 import bashDescription from "../prompts/tools/bash.md" with { type: "text" };
 import { type ContainmentFence, containmentStatus, fenceVerdict } from "../sandbox/containment";
-import { resolveSessionFence } from "../sandbox/session-fence";
+import { resolveSessionFence, SANDBOX_OPERATOR_HOME_ENV, SANDBOX_SESSION_ROOT_ENV } from "../sandbox/session-fence";
 import { SECRET_ENV_PATTERNS, type SecretObfuscator } from "../secrets";
 import { DEFAULT_MAX_BYTES, TailBuffer } from "../session/streaming-output";
 import { renderStatusLine } from "../tui";
@@ -557,11 +558,11 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 	 * RPC `bash` reach it too, and the same brush-core runs credential helpers and the interactive
 	 * `xcsh shell`. Only the model's tool call is fenced (#2554).
 	 */
-	#containmentFence() {
+	#containmentFence(root = this.#containmentRoot()) {
 		const artifactsDir = this.session.getArtifactsDir?.();
 		// One resolver, shared with `sandbox-guard` and the internal-URL check, so the pre-check and the
 		// kernel cannot be looking at different boundaries (#2624).
-		return resolveSessionFence(this.#containmentRoot(), this.session.settings, {
+		return resolveSessionFence(root, this.session.settings, {
 			extraRoots: artifactsDir ? [artifactsDir] : [],
 		});
 	}
@@ -583,7 +584,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		ctx?: AgentToolContext,
 	): Promise<AgentToolResult<BashToolDetails>> {
 		let command = rawCommand;
-		const env = normalizeBashEnv(rawEnv);
+		const requestedEnv = normalizeBashEnv(rawEnv);
 
 		// Extract leading `cd <path> && ...` into cwd when the model ignores the cwd parameter.
 		if (!cwd) {
@@ -627,7 +628,20 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		// different configurations — which doubled a cost that lands as user-visible latency. Sharing is
 		// also the more correct answer: the internal-URL check and the shell are then reasoning about the
 		// same boundary rather than two that merely agree today.
-		const fence = this.#containmentFence();
+		const containmentRoot = this.#containmentRoot();
+		const fence = this.#containmentFence(containmentRoot);
+		// A nested `xcsh sandbox check` must exercise the grants of this exact live profile. Seatbelt and
+		// Landlock restrictions compose and cannot be relaxed by its subprocess, so the diagnostic needs
+		// the immutable session anchor even when this individual call uses `cwd` or starts with `cd`.
+		// Keep these values host-owned: tool-supplied env cannot replace them.
+		const env =
+			fence === undefined
+				? requestedEnv
+				: {
+						...requestedEnv,
+						[SANDBOX_SESSION_ROOT_ENV]: containmentRoot,
+						[SANDBOX_OPERATOR_HOME_ENV]: os.homedir(),
+					};
 
 		const localOptions = {
 			getArtifactsDir: this.session.getArtifactsDir,