@f5-sales-demo/xcsh 20.1.1 → 20.1.2

package/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 ## [Unreleased]
 
+## [20.1.2] - 2026-08-01
+
+### Fixed
+
+- Made `xcsh sandbox check` work for sessions rooted directly under the operator home, distinguish harness errors from sandbox failures, and verify this topology against installed release artifacts ([#2807](https://github.com/f5-sales-demo/xcsh/issues/2807))
+
 ## [20.1.1] - 2026-08-01
 
 ### Fixed

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@f5-sales-demo/xcsh",
-	"version": "20.1.1",
+	"version": "20.1.2",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/f5-sales-demo/xcsh",
 	"author": "Can Boluk",
@@ -57,13 +57,13 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.3.0",
 		"@mozilla/readability": "^0.6",
-		"@f5-sales-demo/xcsh-stats": "20.1.1",
-		"@f5-sales-demo/pi-agent-core": "20.1.1",
-		"@f5-sales-demo/pi-ai": "20.1.1",
-		"@f5-sales-demo/pi-natives": "20.1.1",
-		"@f5-sales-demo/pi-resource-management": "20.1.1",
-		"@f5-sales-demo/pi-tui": "20.1.1",
-		"@f5-sales-demo/pi-utils": "20.1.1",
+		"@f5-sales-demo/xcsh-stats": "20.1.2",
+		"@f5-sales-demo/pi-agent-core": "20.1.2",
+		"@f5-sales-demo/pi-ai": "20.1.2",
+		"@f5-sales-demo/pi-natives": "20.1.2",
+		"@f5-sales-demo/pi-resource-management": "20.1.2",
+		"@f5-sales-demo/pi-tui": "20.1.2",
+		"@f5-sales-demo/pi-utils": "20.1.2",
 		"@sinclair/typebox": "^0.34",
 		"@xterm/headless": "^6.0",
 		"ajv": "^8.20",

package/src/cli/sandbox-check.ts

@@ -8,15 +8,19 @@ import { Settings } from "../config/settings";
 import { fenceForNative } from "../exec/bash-executor";
 import { buildContainmentFence, type ContainmentFence, containmentStatus } from "../sandbox/containment";
 import { evaluateToolCall } from "../sandbox/enforce";
-import { SANDBOX_OPERATOR_HOME_ENV, SANDBOX_SESSION_ROOT_ENV } from "../sandbox/session-fence";
+import {
+	SANDBOX_CHECK_NAMED_SIBLING_ENV,
+	SANDBOX_OPERATOR_HOME_ENV,
+	SANDBOX_SESSION_ROOT_ENV,
+} from "../sandbox/session-fence";
 import { BashTool, type ToolSession } from "../tools";
 
-export type SandboxCheckResultStatus = "PASS" | "FAIL" | "SKIP";
+export type SandboxCheckResultStatus = "PASS" | "FAIL" | "SKIP" | "ERROR";
 
 export interface SandboxCheckResult {
 	name: string;
 	status: SandboxCheckResultStatus;
-	/** Present on failures and skips; paths are generalized before they leave the process. */
+	/** Present on failures, errors, and skips; paths are generalized before they leave the process. */
 	detail?: string;
 }
 
@@ -27,6 +31,7 @@ export interface SandboxCheckReport {
 	summary: {
 		passed: number;
 		failed: number;
+		errors: number;
 		skipped: number;
 	};
 }
@@ -142,15 +147,19 @@ function renderReport(report: SandboxCheckReport, json: boolean, verbose: boolea
 
 	const enforcement = report.osEnforced ? "OS enforced" : "scanner only";
 	process.stdout.write(`Sandbox backend: ${report.backend} (${enforcement})\n\n`);
-	const width = Math.max(0, ...report.checks.map(check => check.name.length));
+	const nameWidth = Math.max(0, ...report.checks.map(check => check.name.length));
+	const statusWidth = Math.max(0, ...report.checks.map(check => check.status.length));
 	for (const check of report.checks) {
-		process.stdout.write(`${check.status.padEnd(4)}  ${check.name.padEnd(width)}\n`);
+		process.stdout.write(`${check.status.padEnd(statusWidth)}  ${check.name.padEnd(nameWidth)}\n`);
 		if (verbose && check.detail) process.stdout.write(`      ${check.detail}\n`);
 	}
 	process.stdout.write(
-		`\n${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.skipped} skipped\n`,
+		`\n${report.summary.passed} passed, ${report.summary.failed} failed, ${report.summary.errors} errors, ${report.summary.skipped} skipped\n`,
 	);
-	if (!verbose && report.summary.failed > 0) {
+	if (report.checks.some(check => check.name === "conformance matrix setup" && check.status === "ERROR")) {
+		process.stdout.write("Conformance matrix did not run.\n");
+	}
+	if (!verbose && (report.summary.failed > 0 || report.summary.errors > 0)) {
 		process.stdout.write("Run `xcsh sandbox check --verbose` for failure details.\n");
 	}
 }
@@ -177,7 +186,7 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		probe: () => boolean | ProbeOutcome | Promise<boolean | ProbeOutcome>,
 	): Promise<void> => {
 		if (abortController.signal.aborted) {
-			add(name, "FAIL", "probe aborted before execution; path=<probe>; errno=ABORTED");
+			add(name, "ERROR", "probe aborted before execution; path=<probe>; errno=ABORTED");
 			return;
 		}
 		try {
@@ -190,18 +199,25 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			);
 		} catch (error) {
 			const outcome = exceptionOutcome("probe threw", "<probe>", error, redactions);
-			add(name, "FAIL", outcome.detail);
+			add(name, "ERROR", outcome.detail);
 		}
 	};
 
 	try {
-		const inheritedProfile = process.env[SANDBOX_SESSION_ROOT_ENV] !== undefined;
-		const workspaceInput = process.env[SANDBOX_SESSION_ROOT_ENV] ?? process.cwd();
-		const homeInput = process.env[SANDBOX_OPERATOR_HOME_ENV] ?? os.homedir();
+		const inheritedWorkspace = process.env[SANDBOX_SESSION_ROOT_ENV];
+		const inheritedHome = process.env[SANDBOX_OPERATOR_HOME_ENV];
+		const inheritedSibling = process.env[SANDBOX_CHECK_NAMED_SIBLING_ENV];
+		const inheritedProfile = inheritedWorkspace !== undefined;
+		const workspaceInput = inheritedWorkspace ?? process.cwd();
+		const homeInput = inheritedHome ?? os.homedir();
 		redactions.push([workspaceInput, "<workspace>"], [homeInput, "<operator-home>"]);
-		const liveWorkspace = await fs.realpath(workspaceInput);
-		const liveHome = await fs.realpath(homeInput);
+		// BashTool owns and canonicalises inherited values before applying Seatbelt/Landlock. Re-running
+		// realpath here can require metadata access that the live profile deliberately withholds from the
+		// session parent — which is the operator home for a `~/<workspace>` layout (#2807).
+		const liveWorkspace = inheritedWorkspace ?? (await fs.realpath(workspaceInput));
+		const liveHome = inheritedHome ?? (await fs.realpath(homeInput));
 		redactions.push([liveWorkspace, "<workspace>"], [liveHome, "<operator-home>"]);
+		if (inheritedSibling !== undefined) redactions.push([inheritedSibling, "<session-parent>/<synthetic-sibling>"]);
 
 		const fixtureBase = inheritedProfile ? liveWorkspace : await fs.realpath(os.tmpdir());
 		fixtureRoot = await fs.mkdtemp(path.join(fixtureBase, ".xcsh-sandbox-check-policy-"));
@@ -309,17 +325,19 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 
 		await check("named sibling remains reachable", async () => {
 			const displayPath = "<session-parent>/<synthetic-sibling>";
-			let liveSibling: string;
-			try {
-				liveSibling = await fs.mkdtemp(path.join(path.dirname(liveWorkspace), ".xcsh-sandbox-check-sibling-"));
-				fixturePaths.push(liveSibling);
-				nonEnumerableCleanupDirs.add(liveSibling);
-				redactions.push([liveSibling, displayPath]);
-				const namedFile = path.join(liveSibling, "named.txt");
-				await Bun.write(namedFile, "sibling\n");
-				knownCleanupLeaves.push(namedFile);
-			} catch (error) {
-				return exceptionOutcome("create named sibling fixture", displayPath, error, redactions);
+			let liveSibling = inheritedSibling;
+			if (liveSibling === undefined) {
+				try {
+					liveSibling = await fs.mkdtemp(path.join(path.dirname(liveWorkspace), ".xcsh-sandbox-check-sibling-"));
+					fixturePaths.push(liveSibling);
+					nonEnumerableCleanupDirs.add(liveSibling);
+					redactions.push([liveSibling, displayPath]);
+					const namedFile = path.join(liveSibling, "named.txt");
+					await Bun.write(namedFile, "sibling\n");
+					knownCleanupLeaves.push(namedFile);
+				} catch (error) {
+					return exceptionOutcome("create named sibling fixture", displayPath, error, redactions);
+				}
 			}
 			const result = await shellProbe(
 				'test "$(cat named.txt)" = sibling',
@@ -485,7 +503,7 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		});
 	} catch (error) {
 		const outcome = exceptionOutcome("conformance matrix setup failed", "<probe>", error, redactions);
-		add("conformance matrix completed", "FAIL", outcome.detail);
+		add("conformance matrix setup", "ERROR", outcome.detail);
 	} finally {
 		process.off("SIGINT", interrupt);
 		process.off("SIGTERM", interrupt);
@@ -511,17 +529,17 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 			}
 		}
 
-		if (fixtureRoot === undefined || cleanupFailures.length > 0) {
+		if (cleanupFailures.length > 0) {
 			add(
 				"synthetic fixtures removed",
-				"FAIL",
+				"ERROR",
 				sanitizeDetail(
-					`fixture cleanup incomplete; path=<synthetic-fixtures>; errno=${
-						fixtureRoot === undefined ? "ENOENT" : "unknown"
-					}${cleanupFailures.length > 0 ? `; error=${cleanupFailures.join("; ")}` : ""}`,
+					`fixture cleanup incomplete; path=<synthetic-fixtures>; errno=unknown; error=${cleanupFailures.join("; ")}`,
 					redactions,
 				),
 			);
+		} else if (fixturePaths.length === 0) {
+			add("synthetic fixtures removed", "SKIP", "setup created no fixtures; path=<synthetic-fixtures>; errno=none");
 		} else {
 			add("synthetic fixtures removed", "PASS");
 		}
@@ -534,6 +552,7 @@ export async function runSandboxCheck(options: SandboxCheckOptions = {}): Promis
 		summary: {
 			passed: checks.filter(result => result.status === "PASS").length,
 			failed: checks.filter(result => result.status === "FAIL").length,
+			errors: checks.filter(result => result.status === "ERROR").length,
 			skipped: checks.filter(result => result.status === "SKIP").length,
 		},
 	};

package/src/commands/sandbox.ts

@@ -21,6 +21,6 @@ export default class Sandbox extends Command {
 	async run(): Promise<void> {
 		const { flags } = await this.parse(Sandbox);
 		const report = await runSandboxCheck({ json: flags.json, verbose: flags.verbose });
-		if (report.summary.failed > 0) process.exitCode = 1;
+		if (report.summary.failed > 0 || report.summary.errors > 0) process.exitCode = 1;
 	}
 }

package/src/internal-urls/build-info.generated.ts

@@ -17,17 +17,17 @@ export interface BuildInfo {
 }
 
 export const BUILD_INFO: BuildInfo = {
-	"version": "20.1.1",
-	"commit": "ac536e6d319a00467e8e95de237cc915b1551dec",
-	"shortCommit": "ac536e6",
+	"version": "20.1.2",
+	"commit": "b5534d98c8ad483cc6e8709b44242cf3ea98041d",
+	"shortCommit": "b5534d9",
 	"branch": "main",
-	"tag": "v20.1.1",
-	"commitDate": "2026-08-01T18:06:22Z",
-	"buildDate": "2026-08-01T18:28:19.612Z",
+	"tag": "v20.1.2",
+	"commitDate": "2026-08-01T21:09:01Z",
+	"buildDate": "2026-08-01T21:30:18.970Z",
 	"dirty": true,
 	"prNumber": "",
 	"repoUrl": "https://github.com/f5-sales-demo/xcsh",
 	"repoSlug": "f5-sales-demo/xcsh",
-	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/ac536e6d319a00467e8e95de237cc915b1551dec",
-	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.1.1"
+	"commitUrl": "https://github.com/f5-sales-demo/xcsh/commit/b5534d98c8ad483cc6e8709b44242cf3ea98041d",
+	"releaseUrl": "https://github.com/f5-sales-demo/xcsh/releases/tag/v20.1.2"
 };

package/src/internal-urls/console-catalog.generated.ts

@@ -2,10 +2,10 @@
 
 import type { ConsoleCatalogData } from "./console-catalog-types";
 
-export const CONSOLE_CATALOG_VERSION = "8e7e1863840cc8ed4db0a9781c695f251aafb214";
+export const CONSOLE_CATALOG_VERSION = "ea6ed666f67f016f68f4e538d1f22e44e18d11a2";
 
 export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
-	version: "8e7e1863840cc8ed4db0a9781c695f251aafb214",
+	version: "ea6ed666f67f016f68f4e538d1f22e44e18d11a2",
 	workflows: {
 		"address-allocator/create":
 			'---\nschema: urn:xcsh:console:workflow:v1\nid: address-allocator-create\nlabel: Create IP Address Allocators\nresource: address-allocator\noperation: create\npreconditions:\n  - user_logged_in\n  - "role_minimum: admin"\nparams:\n  name:\n    required: true\n    description: IP Address Allocators name (lowercase alphanumeric and hyphens)\n    example: example-address-allocator\n  address_allocator_mode:\n    required: true\n    description: Address Allocator Mode\n  allocation_unit:\n    required: false\n    description: Allocation Unit\n    default: 0\n  address_pool:\n    required: false\n    description: Address Pool\n    default: value\n  address_allocation_scheme:\n    required: false\n    description: "Server-required: Field should be not nil"\n    default: value\nsteps:\n  - id: navigate-to-list\n    action: navigate\n    url: /web/workspaces/multi-cloud-network-connect/manage/networking/legacy_network_configuration/address_allocators\n    wait_for: text(\'IP Address Allocators\')\n    description: Navigate to IP Address Allocators list page\n  - id: click-add-tab\n    action: click\n    selector: text(\'Add IP Address Allocator\')\n    wait_for: textbox[name=\'Name\']\n    description: Click Add IP Address Allocator to open the create form\n  - id: fill-name\n    action: fill\n    selector: textbox[name=\'Name\']\n    value: "{name}"\n    description: Enter Name\n  - id: select-address_allocator_mode\n    action: select\n    selector: listbox\n    context: Address Allocator Mode section\n    value: "{address_allocator_mode}"\n    description: Select Address Allocator Mode\n  - id: fill-allocation_unit\n    action: fill\n    selector: spinbutton[name=\'Allocation Unit\']\n    value: "{allocation_unit}"\n    description: Set Allocation Unit\n  - id: fill-address_pool\n    action: fill\n    selector: ngx-datatable input.form-control\n    context: Address Pool table\n    value: "{address_pool}"\n    description: Enter Address Pool in the existing table row (no Add Item needed — the table ships one empty row)\n  - id: select-address_allocation_scheme\n    action: select\n    selector: listbox\n    context: Address Allocation Scheme section\n    value: "{address_allocation_scheme}"\n    description: Select Address Allocation Scheme\n  - id: save\n    action: click\n    selector: "[class*=\'save-bt\'],[class*=\'submit-button\']"\n    context: footer\n    wait_for: text(\'{name}\')\n    wait_timeout_ms: 30000\n    description: Save/submit the form (union selector matches save-bt OR submit-button)\npostconditions:\n  - resource_list_page_visible\n  - "resource_name_in_list: {name}"\nmetadata:\n  confidence: inferred\n  discovered_at: 2026-06-24\n  console_version: "2025.06"\n  notes: Auto-generated by scripts/generate-workflows.ts from api-specs-enriched field metadata.\n',
@@ -978,8 +978,6 @@ export const CONSOLE_CATALOG_DATA: ConsoleCatalogData = {
 			"---\nschema: urn:xcsh:console:resource:v1\nid: securemesh-site\nlabel: Secure Mesh Sites\n_source: Generated from api-specs-enriched/config/console_ui.yaml\napi:\n  kind: securemesh_site\nconsole:\n  workspace: multi-cloud-network-connect\n  workspace_label: Multi-Cloud Network Connect\n  route_prefix: /web/workspaces/multi-cloud-network-connect\n  route_pattern: /manage/site_management/legacy_configs/securemesh_site\n  menu_path:\n    - Manage\n    - Site Management\n    - Legacy Configurations\n    - Secure Mesh Sites\n  breadcrumbs:\n    - Home\n    - Multi-Cloud Network Connect\n    - Manage\n    - Site Management\n    - Legacy Configurations\n    - Secure Mesh Sites\n  namespace_scoped: false\nadd_action:\n  type: tab\n  label: Add Secure Mesh Site\nsave_action:\n  label: Add Secure Mesh Site\ncancel_action:\n  label: Cancel All\nform_tabs:\n  - Form\n  - Documentation\n  - JSON\nform:\n  sections:\n    - id: metadata\n      label: Metadata\n      api_fields:\n        - metadata.name\n        - metadata.labels\n        - metadata.description\nenriched_fields:\n  count: 25\n  source: api-specs-enriched/config/console_field_metadata.yaml\nmetadata:\n  confidence: validated\n  discovered_at: '2026-06-16'\n  console_version: '2025.06'\n",
 		"securemesh-site-v2":
 			"---\nschema: urn:xcsh:console:resource:v1\nid: securemesh-site-v2\nlabel: Secure Mesh Sites v2\n_source: Generated from api-specs-enriched/config/console_ui.yaml\napi:\n  kind: securemesh_site_v2\nconsole:\n  workspace: multi-cloud-network-connect\n  workspace_label: Multi-Cloud Network Connect\n  route_prefix: /web/workspaces/multi-cloud-network-connect\n  route_pattern: /manage/site_management/cloud_sites/securemesh_site_v2\n  menu_path:\n    - Manage\n    - Site Management\n    - Customer Edges\n    - Secure Mesh Sites v2\n  breadcrumbs:\n    - Home\n    - Multi-Cloud Network Connect\n    - Manage\n    - Site Management\n    - Customer Edges\n    - Secure Mesh Sites v2\n  namespace_scoped: false\nadd_action:\n  type: tab\n  label: Add Secure Mesh Site v2\nsave_action:\n  label: Add Secure Mesh Site v2\ncancel_action:\n  label: Cancel All\nform_tabs:\n  - Form\n  - Documentation\n  - JSON\nform:\n  sections:\n    - id: metadata\n      label: Metadata\n      api_fields:\n        - metadata.name\n        - metadata.labels\n        - metadata.description\nenriched_fields:\n  count: 8\n  source: api-specs-enriched/config/console_field_metadata.yaml\nmetadata:\n  confidence: validated\n  discovered_at: '2026-06-16'\n  console_version: '2025.06'\n",
-		"securemesh-site-v2-cloud":
-			"---\nschema: urn:xcsh:console:resource:v1\nid: securemesh-site-v2-cloud\nlabel: Secure Mesh Sites v2\n_source: Generated from api-specs-enriched/config/console_ui.yaml\napi:\n  kind: securemesh_site_v2_cloud\nconsole:\n  workspace: multi-cloud-network-connect\n  workspace_label: Multi-Cloud Network Connect\n  route_prefix: /web/workspaces/multi-cloud-network-connect\n  route_pattern: /manage/site_management/cloud_sites/securemesh_site_v2\n  menu_path:\n    - Manage\n    - Site Management\n    - Customer Edges\n    - Secure Mesh Sites v2\n  breadcrumbs:\n    - Home\n    - Multi-Cloud Network Connect\n    - Manage\n    - Site Management\n    - Customer Edges\n    - Secure Mesh Sites v2\n  namespace_scoped: false\nadd_action:\n  type: tab\n  label: Add Secure Mesh Site\nsave_action:\n  label: Add Secure Mesh Site\ncancel_action:\n  label: Cancel All\nform_tabs:\n  - Form\n  - Documentation\n  - JSON\nform:\n  sections:\n    - id: metadata\n      label: Metadata\n      api_fields:\n        - metadata.name\n        - metadata.labels\n        - metadata.description\nmetadata:\n  confidence: validated\n  discovered_at: '2026-06-17'\n  console_version: '2025.06'\n  notes: This is the v2 cloud sites path — differs from securemesh_site_v2 which may have a different route\n",
 		segment:
 			"---\nschema: urn:xcsh:console:resource:v1\nid: segment\nlabel: Segments\n_source: Generated from api-specs-enriched/config/console_ui.yaml\napi:\n  kind: segment\nconsole:\n  workspace: multi-cloud-network-connect\n  workspace_label: Multi-Cloud Network Connect\n  route_prefix: /web/workspaces/multi-cloud-network-connect\n  route_pattern: /manage/networking/network_configuration/segment\n  menu_path:\n    - Manage\n    - Networking\n    - Network Configuration\n    - Segments\n  breadcrumbs:\n    - Home\n    - Multi-Cloud Network Connect\n    - Manage\n    - Networking\n    - Network Configuration\n    - Segments\n  namespace_scoped: false\nadd_action:\n  type: tab\n  label: Add Segment\nsave_action:\n  label: Add Segment\ncancel_action:\n  label: Cancel All\nform_tabs:\n  - Form\n  - Documentation\n  - JSON\nform:\n  sections:\n    - id: metadata\n      label: Metadata\n      api_fields:\n        - metadata.name\n        - metadata.labels\n        - metadata.description\nenriched_fields:\n  count: 4\n  source: api-specs-enriched/config/console_field_metadata.yaml\nmetadata:\n  confidence: validated\n  discovered_at: '2026-06-16'\n  console_version: '2025.06'\n",
 		"segment-connection":

package/src/sandbox/session-fence.ts

@@ -26,6 +26,7 @@ import { buildContainmentFence, type ContainmentFence } from "./containment";
  */
 export const SANDBOX_SESSION_ROOT_ENV = "XCSH_SANDBOX_SESSION_ROOT";
 export const SANDBOX_OPERATOR_HOME_ENV = "XCSH_SANDBOX_OPERATOR_HOME";
+export const SANDBOX_CHECK_NAMED_SIBLING_ENV = "XCSH_SANDBOX_CHECK_NAMED_SIBLING";
 
 /** The slice of `Settings` this needs — supplied explicitly so the caller names its own source. */
 export interface SettingsReader {

package/src/tools/bash.ts

@@ -1,5 +1,6 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
+import * as path from "node:path";
 import type {
 	AgentTool,
 	AgentToolContext,
@@ -18,7 +19,12 @@ import { truncateToVisualLines } from "../modes/components/visual-truncate";
 import type { Theme } from "../modes/theme/theme";
 import bashDescription from "../prompts/tools/bash.md" with { type: "text" };
 import { type ContainmentFence, containmentStatus, fenceVerdict } from "../sandbox/containment";
-import { resolveSessionFence, SANDBOX_OPERATOR_HOME_ENV, SANDBOX_SESSION_ROOT_ENV } from "../sandbox/session-fence";
+import {
+	resolveSessionFence,
+	SANDBOX_CHECK_NAMED_SIBLING_ENV,
+	SANDBOX_OPERATOR_HOME_ENV,
+	SANDBOX_SESSION_ROOT_ENV,
+} from "../sandbox/session-fence";
 import { SECRET_ENV_PATTERNS, type SecretObfuscator } from "../secrets";
 import { DEFAULT_MAX_BYTES, TailBuffer } from "../session/streaming-output";
 import { renderStatusLine } from "../tui";
@@ -178,6 +184,21 @@ function normalizeBashEnv(env: Record<string, string> | undefined): Record<strin
 	return normalized;
 }
 
+/** Canonical context resolved by the unfenced host before a child inherits the live profile. */
+async function canonicalizeSandboxContextPath(input: string): Promise<string> {
+	try {
+		return await fs.promises.realpath(input);
+	} catch {
+		// The fence builder already handles an unavailable home conservatively. Keep ordinary bash calls
+		// working in that case; the diagnostic will report the path-specific failure if it is invoked.
+		return input;
+	}
+}
+
+function invokesSandboxCheck(command: string): boolean {
+	return /(?:xcsh(?:-[a-z0-9-]+)?|cli\.ts)["']?\s+["']?sandbox["']?\s+["']?check["']?(?:\s|$)/iu.test(command);
+}
+
 function escapeBashEnvValueForDisplay(value: string): string {
 	return value
 		.replaceAll("\\", "\\\\")
@@ -630,18 +651,25 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		// same boundary rather than two that merely agree today.
 		const containmentRoot = this.#containmentRoot();
 		const fence = this.#containmentFence(containmentRoot);
+		const sandboxCheckInvocation = fence !== undefined && invokesSandboxCheck(command);
 		// A nested `xcsh sandbox check` must exercise the grants of this exact live profile. Seatbelt and
 		// Landlock restrictions compose and cannot be relaxed by its subprocess, so the diagnostic needs
 		// the immutable session anchor even when this individual call uses `cwd` or starts with `cd`.
 		// Keep these values host-owned: tool-supplied env cannot replace them.
-		const env =
-			fence === undefined
-				? requestedEnv
-				: {
-						...requestedEnv,
-						[SANDBOX_SESSION_ROOT_ENV]: containmentRoot,
-						[SANDBOX_OPERATOR_HOME_ENV]: os.homedir(),
-					};
+		let env = requestedEnv;
+		let trustedSessionRoot = containmentRoot;
+		if (fence !== undefined) {
+			const [canonicalSessionRoot, trustedOperatorHome] = await Promise.all([
+				canonicalizeSandboxContextPath(containmentRoot),
+				canonicalizeSandboxContextPath(os.homedir()),
+			]);
+			trustedSessionRoot = canonicalSessionRoot;
+			env = {
+				...requestedEnv,
+				[SANDBOX_SESSION_ROOT_ENV]: trustedSessionRoot,
+				[SANDBOX_OPERATOR_HOME_ENV]: trustedOperatorHome,
+			};
+		}
 
 		const localOptions = {
 			getArtifactsDir: this.session.getArtifactsDir,
@@ -684,6 +712,9 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		const obfuscator = this.session.obfuscator;
 		_sessionObfuscator = obfuscator; // Keep module-level ref fresh for renderer
 		const maskSecrets = obfuscator?.hasSecrets() ? (t: string) => obfuscator.obfuscate(t) : undefined;
+		if (asyncRequested && sandboxCheckInvocation) {
+			throw new ToolError("Sandbox check must run synchronously so its synthetic fixtures can be removed.");
+		}
 
 		if (asyncRequested) {
 			if (!this.session.asyncJobManager) {
@@ -704,7 +735,7 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 			return this.#buildBackgroundStartResult(job.jobId, job.label, "", timeoutSec);
 		}
 
-		if (this.#autoBackgroundEnabled && !pty && this.session.asyncJobManager) {
+		if (this.#autoBackgroundEnabled && !pty && this.session.asyncJobManager && !sandboxCheckInvocation) {
 			const autoBackgroundWaitMs = this.#resolveAutoBackgroundWaitMs(timeoutMs);
 			const startBackgrounded = autoBackgroundWaitMs === 0;
 			const job = this.#startManagedBashJob({
@@ -762,41 +793,60 @@ export class BashTool implements AgentTool<BashToolSchema, BashToolDetails> {
 		const osBackend = containmentStatus(fence !== undefined);
 		const ptyConfinable = !osBackend.osEnforced || osBackend.backend === "seatbelt";
 		const usePty = pty && ptyConfinable && $env.PI_NO_PTY !== "1" && ctx?.hasUI === true && ctx.ui !== undefined;
-		const result: BashResult | BashInteractiveResult = usePty
-			? await runInteractiveBashPty(ctx.ui!, {
-					command,
-					cwd: commandCwd,
-					timeoutMs,
-					signal,
-					env,
-					artifactPath,
-					artifactId,
-					maskSecrets,
-					// The same fence that decided `ptyConfinable`, so the gate and the enforcement can
-					// never be looking at different answers.
-					fence,
-				})
-			: await executeBash(command, {
-					cwd: commandCwd,
-					sessionKey: this.session.getSessionId?.() ?? undefined,
-					timeout: timeoutMs,
-					signal,
-					env,
-					artifactPath,
-					artifactId,
-					maskSecrets,
-					fence,
-					onChunk: chunk => {
-						tailBuffer.append(chunk);
-						if (onUpdate) {
-							const preview = maskSecrets ? maskSecrets(tailBuffer.text()) : tailBuffer.text();
-							onUpdate({
-								content: [{ type: "text", text: preview }],
-								details: {},
-							});
-						}
-					},
-				});
+		let sandboxCheckSibling: string | undefined;
+		if (sandboxCheckInvocation) {
+			// Landlock cannot add a newly-created child to an already-applied profile. Prepare the named
+			// sibling before the child is confined so the diagnostic measures reachability, not whether a
+			// nested sandbox can widen itself. The host owns both this path and its cleanup.
+			sandboxCheckSibling = await fs.promises.mkdtemp(
+				path.join(path.dirname(trustedSessionRoot), ".xcsh-sandbox-check-live-sibling-"),
+			);
+			await Bun.write(path.join(sandboxCheckSibling, "named.txt"), "sibling\n");
+			env = { ...env, [SANDBOX_CHECK_NAMED_SIBLING_ENV]: sandboxCheckSibling };
+		}
+
+		let result: BashResult | BashInteractiveResult;
+		try {
+			result = usePty
+				? await runInteractiveBashPty(ctx.ui!, {
+						command,
+						cwd: commandCwd,
+						timeoutMs,
+						signal,
+						env,
+						artifactPath,
+						artifactId,
+						maskSecrets,
+						// The same fence that decided `ptyConfinable`, so the gate and the enforcement can
+						// never be looking at different answers.
+						fence,
+					})
+				: await executeBash(command, {
+						cwd: commandCwd,
+						sessionKey: this.session.getSessionId?.() ?? undefined,
+						timeout: timeoutMs,
+						signal,
+						env,
+						artifactPath,
+						artifactId,
+						maskSecrets,
+						fence,
+						onChunk: chunk => {
+							tailBuffer.append(chunk);
+							if (onUpdate) {
+								const preview = maskSecrets ? maskSecrets(tailBuffer.text()) : tailBuffer.text();
+								onUpdate({
+									content: [{ type: "text", text: preview }],
+									details: {},
+								});
+							}
+						},
+					});
+		} finally {
+			if (sandboxCheckSibling !== undefined) {
+				await fs.promises.rm(sandboxCheckSibling, { recursive: true, force: true });
+			}
+		}
 		if (result.cancelled) {
 			if (signal?.aborted) {
 				throw new ToolAbortError(normalizeResultOutput(result) || "Command aborted");