@gethmy/harness 1.4.0 → 1.6.0

package/dist/index.js

@@ -584,7 +584,6 @@ var init_stageHandoff = __esm(() => {
 
 // ../harmony-shared/dist/types.js
 var init_types = () => {};
-
 // ../harmony-shared/dist/index.js
 var init_dist = __esm(() => {
   init_agentStaleness();
@@ -610,6 +609,492 @@ var init_dist = __esm(() => {
   init_types();
 });
 
+// src/confine-to-repo.ts
+import { realpathSync } from "node:fs";
+import { dirname, isAbsolute, parse, resolve, sep } from "node:path";
+function isGitMetadata(repoRoot, candidate) {
+  const rel = candidate.startsWith(repoRoot) ? candidate.slice(repoRoot.length) : candidate;
+  return rel.split(/[\\/]/).some((segment) => segment.toLowerCase() === ".git");
+}
+function patternEscapes(pattern) {
+  if (isAbsolute(pattern))
+    return true;
+  if (/[{}[\]~()!+@]/.test(pattern))
+    return true;
+  return pattern.split(/[\\/]/).some((segment) => segment === "..");
+}
+function pathArgsFor(mode) {
+  return mode === "write" ? { ...READ_PATH_ARGS, ...WRITE_PATH_ARGS } : READ_PATH_ARGS;
+}
+function realPathOrNearest(p) {
+  const abs = isAbsolute(p) ? p : resolve(p);
+  const { root } = parse(abs);
+  let real = root;
+  for (const part of abs.slice(root.length).split(sep)) {
+    if (part === "" || part === ".")
+      continue;
+    if (part === "..") {
+      real = dirname(real);
+      continue;
+    }
+    const next = real.endsWith(sep) ? real + part : real + sep + part;
+    try {
+      real = realpathSync(next);
+    } catch {
+      real = next;
+    }
+  }
+  return real;
+}
+function isInsideTree(root, target) {
+  const normalizedRoot = realPathOrNearest(root);
+  const normalizedTarget = realPathOrNearest(target);
+  if (normalizedTarget === normalizedRoot)
+    return true;
+  return normalizedTarget.startsWith(normalizedRoot + sep);
+}
+function decideConfinedTool(repoRoot, toolName, input, mode = "read") {
+  const pathArgs = pathArgsFor(mode)[toolName];
+  if (!pathArgs) {
+    return {
+      behavior: "deny",
+      message: `${toolName} is not available to this run.`
+    };
+  }
+  const verb = toolName in WRITE_PATH_ARGS ? "write" : "read";
+  for (const key of PATTERN_ARG_BY_TOOL[toolName] ?? []) {
+    const value = input[key];
+    if (typeof value !== "string" || value.length === 0)
+      continue;
+    if (patternEscapes(value)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} patterns must stay inside the repository — no absolute path and no "..". Refused: ${value}`
+      };
+    }
+  }
+  for (const key of pathArgs) {
+    const value = input[key];
+    if (typeof value !== "string" || value.length === 0)
+      continue;
+    const candidate = isAbsolute(value) ? value : `${repoRoot}${sep}${value}`;
+    if (isGitMetadata(repoRoot, candidate)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} may not touch the repository's git metadata. Refused: ${value}`
+      };
+    }
+    if (!isInsideTree(repoRoot, candidate)) {
+      return {
+        behavior: "deny",
+        message: `${toolName} may only ${verb} inside the repository. Refused: ${value}`
+      };
+    }
+  }
+  return { behavior: "allow" };
+}
+function confineToRepo(repoRoot, mode = "read") {
+  return async (toolName, input) => decideConfinedTool(repoRoot, toolName, input, mode);
+}
+var READ_PATH_ARGS, WRITE_PATH_ARGS, CONFINED_READ_TOOLS, CONFINED_WRITE_TOOLS, PATTERN_ARG_BY_TOOL;
+var init_confine_to_repo = __esm(() => {
+  READ_PATH_ARGS = {
+    Read: ["file_path", "path", "notebook_path"],
+    Grep: ["path"],
+    Glob: ["path"]
+  };
+  WRITE_PATH_ARGS = {
+    Write: ["file_path"],
+    Edit: ["file_path"],
+    MultiEdit: ["file_path"],
+    NotebookEdit: ["notebook_path"]
+  };
+  CONFINED_READ_TOOLS = Object.freeze(Object.keys(READ_PATH_ARGS));
+  CONFINED_WRITE_TOOLS = Object.freeze([
+    ...Object.keys(READ_PATH_ARGS),
+    ...Object.keys(WRITE_PATH_ARGS).filter((t) => t !== "MultiEdit")
+  ]);
+  PATTERN_ARG_BY_TOOL = {
+    Glob: ["pattern"],
+    Grep: ["glob"]
+  };
+});
+
+// src/runner.ts
+import { getConfigDir } from "@gethmy/mcp/src/config.js";
+function mayHoldCredentials(role) {
+  return role === "author" || role === "reviewer";
+}
+function credentialReadDeny() {
+  return `Read(/${getConfigDir()}/**)`;
+}
+function credentialAccessDeny() {
+  const dir = `/${getConfigDir()}/**`;
+  return [`Read(${dir})`, `Grep(${dir})`, `Glob(${dir})`];
+}
+function buildRoleLaunch(args) {
+  const role = normalizeStageRole(args.role);
+  const keep = mayHoldCredentials(role);
+  const env = {};
+  for (const [key, value] of Object.entries(args.parentEnv)) {
+    if (value === undefined)
+      continue;
+    if (!keep && HARMONY_CREDENTIAL_KEYS.includes(key))
+      continue;
+    env[key] = value;
+  }
+  return {
+    role,
+    prompt: args.prompt,
+    repoPath: args.repoPath,
+    env,
+    disallowedTools: keep ? [] : [credentialReadDeny()]
+  };
+}
+function envKeysDroppedByLaunch(parentEnv, launch) {
+  return Object.keys(parentEnv).filter((key) => parentEnv[key] !== undefined && !Object.hasOwn(launch.env, key));
+}
+var HARMONY_CREDENTIAL_KEYS;
+var init_runner = __esm(() => {
+  init_dist();
+  HARMONY_CREDENTIAL_KEYS = [
+    "HARMONY_API_KEY",
+    "HARMONY_API_URL",
+    "HARMONY_WORKSPACE_ID",
+    "SUPABASE_ANON_KEY",
+    "SUPABASE_SERVICE_ROLE_KEY",
+    "SUPABASE_URL"
+  ];
+});
+
+// src/run-containment.ts
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createRequire as createRequire2 } from "node:module";
+import { homedir, tmpdir } from "node:os";
+import { dirname as dirname2, isAbsolute as isAbsolute2, join } from "node:path";
+import { getConfigDir as getConfigDir2 } from "@gethmy/mcp/src/config.js";
+function credentialDirectories() {
+  const home = homedir();
+  return [
+    getConfigDir2(),
+    join(home, ".claude"),
+    join(home, ".claude.json"),
+    join(home, ".ssh"),
+    join(home, ".gnupg"),
+    join(home, ".aws"),
+    join(home, ".codex"),
+    join(home, ".gemini"),
+    join(home, ".config", "gh"),
+    join(home, ".config", "gcloud"),
+    join(home, ".config", "anthropic"),
+    join(home, ".config", "op"),
+    join(home, ".docker"),
+    join(home, ".kube"),
+    join(home, ".netrc"),
+    join(home, ".npmrc"),
+    join(home, ".git-credentials")
+  ];
+}
+function writeOnlyDenyPaths() {
+  const paths = [join(homedir(), ".gitconfig")];
+  const xdg = process.env.XDG_CONFIG_HOME;
+  paths.push(xdg && isAbsolute2(xdg) ? join(xdg, "git") : join(homedir(), ".config", "git"));
+  return paths;
+}
+function credentialToolDeny() {
+  return credentialDirectories().flatMap((dir) => [
+    `Read(/${dir})`,
+    `Read(/${dir}/**)`
+  ]);
+}
+function toolchainCacheDirectories(worktree) {
+  const home = homedir();
+  const scratch = `harmony-run-${createHash("sha256").update(worktree).digest("hex").slice(0, 16)}`;
+  const candidate = process.env.TMPDIR ?? tmpdir();
+  const tmpRoot = isAbsolute2(candidate) ? candidate : "/tmp";
+  return [
+    join(home, ".bun", "install", "cache"),
+    join(home, ".npm", "_cacache"),
+    join(tmpRoot, scratch)
+  ];
+}
+function secretEnvKeysToStrip(parentEnv = process.env) {
+  const stripped = new Set(HARMONY_CREDENTIAL_KEYS);
+  for (const key of Object.keys(parentEnv)) {
+    if (KEEP_ENV_KEYS.has(key))
+      continue;
+    if (SECRET_ENV_PATTERN.test(key))
+      stripped.add(key);
+  }
+  return [...stripped];
+}
+function assertNoProjectSandboxOverride(worktree) {
+  for (const name of ["settings.json", "settings.local.json"]) {
+    const path = join(worktree, ".claude", name);
+    let raw;
+    try {
+      raw = readFileSync(path, "utf-8");
+    } catch {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      continue;
+    }
+    if (parsed === null || typeof parsed !== "object")
+      continue;
+    const offending = Object.keys(parsed).filter((key) => !INERT_PROJECT_SETTING_KEYS.has(key));
+    if (offending.length > 0) {
+      throw new ProjectSandboxOverrideError(path, offending);
+    }
+  }
+}
+function containedEnv(parentEnv = process.env) {
+  const strip = new Set(secretEnvKeysToStrip(parentEnv));
+  const out = {};
+  for (const [key, value] of Object.entries(parentEnv)) {
+    if (value === undefined || strip.has(key))
+      continue;
+    out[key] = value;
+  }
+  return out;
+}
+function gitMetadataDenyPaths(worktree) {
+  const paths = new Set;
+  const dotGit = join(worktree, ".git");
+  const require2 = createRequire2(import.meta.url);
+  const { execFileSync } = require2("node:child_process");
+  const { statSync } = require2("node:fs");
+  const gitDirs = new Set;
+  try {
+    const out = execFileSync("git", [...GIT_NO_HOOKS, "rev-parse", "--git-dir", "--git-common-dir"], { cwd: worktree, encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"] });
+    for (const line of out.split(`
+`)) {
+      const trimmed = line.trim();
+      if (!trimmed)
+        continue;
+      gitDirs.add(isAbsolute2(trimmed) ? trimmed : join(worktree, trimmed));
+    }
+  } catch {}
+  gitDirs.add(dotGit);
+  for (const dir of gitDirs) {
+    paths.add(join(dir, "config"));
+    paths.add(join(dir, "config.worktree"));
+    paths.add(join(dir, "hooks"));
+  }
+  try {
+    if (statSync(dotGit).isFile())
+      paths.add(dotGit);
+  } catch {}
+  return [...paths];
+}
+function hostPersistencePaths() {
+  const home = homedir();
+  return [
+    join(home, ".zshenv"),
+    join(home, ".zprofile"),
+    join(home, ".zshrc"),
+    join(home, ".zlogin"),
+    join(home, ".bashrc"),
+    join(home, ".bash_profile"),
+    join(home, ".bash_login"),
+    join(home, ".profile"),
+    join(home, ".config", "fish", "config.fish"),
+    join(home, ".config", "fish", "conf.d"),
+    join(home, "Library", "LaunchAgents"),
+    join(home, ".config", "systemd", "user"),
+    join(home, ".config", "autostart")
+  ];
+}
+function credentialWriteToolDeny(worktree) {
+  return [
+    ...credentialDirectories(),
+    ...writeOnlyDenyPaths(),
+    ...hostPersistencePaths(),
+    ...gitMetadataDenyPaths(worktree)
+  ].flatMap((p) => [`Edit(/${p})`, `Edit(/${p}/**)`]);
+}
+function implementRunToolPolicy(args) {
+  const writable = [args.worktree, ...toolchainCacheDirectories(args.worktree)];
+  const gitMeta = gitMetadataDenyPaths(args.worktree);
+  const secrets = credentialDirectories();
+  return async (toolName, input) => {
+    const allow = { behavior: "allow", updatedInput: input };
+    const deny = (message) => ({ behavior: "deny", message });
+    if (toolName.startsWith("mcp__"))
+      return allow;
+    if (toolName === "Bash" || toolName === "BashOutput") {
+      return allow;
+    }
+    const writePaths = WRITE_TOOL_PATHS[toolName];
+    if (writePaths) {
+      if (args.readOnly === true) {
+        return deny(`${toolName} is not available to a review run.`);
+      }
+      for (const key of writePaths) {
+        const value = input[key];
+        if (typeof value !== "string" || value.length === 0)
+          continue;
+        const target = isAbsolute2(value) ? value : join(args.worktree, value);
+        if (gitMeta.some((p) => isInsideTree(p, target) || p === target)) {
+          return deny(`${toolName} may not touch git metadata. Refused: ${value}`);
+        }
+        if (!writable.some((root) => isInsideTree(root, target))) {
+          return deny(`${toolName} may only write inside this run's worktree. Refused: ${value}`);
+        }
+      }
+      return allow;
+    }
+    const readPaths = READ_TOOL_PATHS[toolName];
+    if (readPaths) {
+      for (const key of readPaths) {
+        const value = input[key];
+        if (typeof value !== "string" || value.length === 0)
+          continue;
+        const target = isAbsolute2(value) ? value : join(args.worktree, value);
+        if (secrets.some((dir) => isInsideTree(dir, target))) {
+          return deny(`${toolName} may not read the credential directories. Refused: ${value}`);
+        }
+      }
+      return allow;
+    }
+    return allow;
+  };
+}
+function harmonyMcpServer() {
+  const require2 = createRequire2(import.meta.url);
+  const cli = join(dirname2(require2.resolve("@gethmy/mcp")), "cli.js");
+  return {
+    harmony: {
+      type: "stdio",
+      command: process.execPath,
+      args: [cli, "serve"]
+    }
+  };
+}
+function implementRunContainment(args) {
+  assertNoProjectSandboxOverride(args.worktree);
+  return {
+    sandbox: {
+      enabled: true,
+      failIfUnavailable: true,
+      allowUnsandboxedCommands: false,
+      autoAllowBashIfSandboxed: args.readOnly !== true,
+      network: {
+        allowedDomains: [...IMPLEMENT_ALLOWED_DOMAINS],
+        allowLocalBinding: false
+      },
+      filesystem: {
+        allowWrite: [
+          args.worktree,
+          ...toolchainCacheDirectories(args.worktree)
+        ],
+        denyRead: credentialDirectories(),
+        denyWrite: [
+          ...credentialDirectories(),
+          ...writeOnlyDenyPaths(),
+          ...hostPersistencePaths(),
+          ...gitMetadataDenyPaths(args.worktree)
+        ]
+      }
+    },
+    canUseTool: implementRunToolPolicy(args),
+    gateEveryToolCall: true,
+    settingSources: args.readOnly === true ? [] : ["project"],
+    mcpServers: harmonyMcpServer(),
+    strictMcpConfig: true,
+    stripEnvKeys: secretEnvKeysToStrip(),
+    disallowedTools: [
+      ...args.extraDisallowedTools ?? [],
+      ...credentialToolDeny(),
+      ...credentialWriteToolDeny(args.worktree)
+    ]
+  };
+}
+function implementRunContainmentCliArgs(args) {
+  const containment = implementRunContainment(args);
+  return [
+    "--settings",
+    JSON.stringify({ sandbox: containment.sandbox }),
+    "--setting-sources",
+    containment.settingSources.join(","),
+    "--mcp-config",
+    JSON.stringify({ mcpServers: containment.mcpServers }),
+    "--strict-mcp-config",
+    "--disallowedTools",
+    containment.disallowedTools.join(",")
+  ];
+}
+var SECRET_ENV_PATTERN, KEEP_ENV_KEYS, ProjectSandboxOverrideError, INERT_PROJECT_SETTING_KEYS, WRITE_TOOL_PATHS, READ_TOOL_PATHS, GIT_NO_HOOKS, IMPLEMENT_ALLOWED_DOMAINS;
+var init_run_containment = __esm(() => {
+  init_confine_to_repo();
+  init_runner();
+  SECRET_ENV_PATTERN = /(TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|API_?KEY|_PAT$|^PAT_|PRIVATE_KEY|ACCESS_KEY)/i;
+  KEEP_ENV_KEYS = new Set([
+    "ANTHROPIC_API_KEY",
+    "ANTHROPIC_AUTH_TOKEN",
+    "ANTHROPIC_BASE_URL",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "SSH_AUTH_SOCK",
+    "GIT_AUTHOR_NAME",
+    "GIT_AUTHOR_EMAIL",
+    "GIT_COMMITTER_NAME",
+    "GIT_COMMITTER_EMAIL",
+    "XAUTHORITY"
+  ]);
+  ProjectSandboxOverrideError = class ProjectSandboxOverrideError extends Error {
+    settingsPath;
+    offendingKeys;
+    constructor(settingsPath, offendingKeys) {
+      super(`Refusing to spawn: ${settingsPath} sets ${offendingKeys.map((k) => `"${k}"`).join(", ")}. ` + "Project settings are loaded so the run can read CLAUDE.md, and that same layer " + "can widen the sandbox (`sandbox.filesystem.allowWrite`) or execute commands " + "outside it (`hooks`, `env`). A run that can write this file could therefore " + "widen its own bounds, so only keys known not to affect execution are accepted. " + "Remove the key, or the run stays refused.");
+      this.settingsPath = settingsPath;
+      this.offendingKeys = offendingKeys;
+      this.name = "ProjectSandboxOverrideError";
+    }
+  };
+  INERT_PROJECT_SETTING_KEYS = new Set([
+    "$schema",
+    "cleanupPeriodDays",
+    "includeCoAuthoredBy",
+    "language",
+    "outputStyle",
+    "spinnerTipsEnabled",
+    "theme",
+    "verbose"
+  ]);
+  WRITE_TOOL_PATHS = {
+    Write: ["file_path"],
+    Edit: ["file_path"],
+    MultiEdit: ["file_path"],
+    NotebookEdit: ["notebook_path"]
+  };
+  READ_TOOL_PATHS = {
+    Read: ["file_path", "path", "notebook_path"],
+    Grep: ["path"],
+    Glob: ["path"]
+  };
+  GIT_NO_HOOKS = [
+    "-c",
+    "core.hooksPath=",
+    "-c",
+    "core.fsmonitor=",
+    "-c",
+    "core.pager=cat"
+  ];
+  IMPLEMENT_ALLOWED_DOMAINS = [
+    "api.anthropic.com",
+    "*.anthropic.com",
+    "registry.npmjs.org",
+    "*.npmjs.org",
+    "github.com",
+    "*.github.com",
+    "*.githubusercontent.com"
+  ];
+});
+
 // src/git-pr.ts
 var exports_git_pr = {};
 __export(exports_git_pr, {
@@ -643,16 +1128,16 @@ __export(exports_git_pr, {
   buildPrBody: () => buildPrBody
 });
 import { execFile as execFile2, execFileSync as execFileSync7 } from "node:child_process";
-import { promisify as promisify2 } from "node:util";
+import { promisify as promisify3 } from "node:util";
 function createExecFileAsync2() {
-  return promisify2(execFile2);
+  return promisify3(execFile2);
 }
 function execFileAsync2() {
   return cachedExecFileAsync2 ??= createExecFileAsync2();
 }
 function detectGitProvider(cwd) {
   try {
-    const url = execFileSync7("git", ["remote", "get-url", "origin"], {
+    const url = execFileSync7("git", [...GIT_NO_HOOKS, "remote", "get-url", "origin"], {
       cwd,
       encoding: "utf-8"
     }).trim();
@@ -702,7 +1187,7 @@ function validateGitProviderCli(provider, cwd) {
     }
     case "bitbucket":
     case "unknown":
-      log.warn(TAG13, `Git provider "${provider}" — PR creation will be skipped (no CLI support)`);
+      log.warn(TAG14, `Git provider "${provider}" — PR creation will be skipped (no CLI support)`);
       break;
   }
 }
@@ -950,7 +1435,7 @@ async function mergePullRequest(prUrl, cwd, provider, strategy, deleteBranch) {
 }
 function getHeadSha(cwd) {
   try {
-    return execFileSync7("git", ["rev-parse", "HEAD"], {
+    return execFileSync7("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd,
       encoding: "utf-8"
     }).trim();
@@ -985,7 +1470,7 @@ async function checkPrMergeStatus(prUrl, cwd, provider) {
         try {
           parsed = JSON.parse(stdout.trim());
         } catch {
-          log.warn(TAG13, `Failed to parse glab JSON output for MR ${mrMatch[1]}`);
+          log.warn(TAG14, `Failed to parse glab JSON output for MR ${mrMatch[1]}`);
           return "unknown";
         }
         if (typeof parsed !== "object" || parsed === null)
@@ -1083,7 +1568,7 @@ async function resolvePrHeadBranch(prUrl, cwd, provider) {
       const { stdout } = await execFileAsync2()("gh", ["pr", "view", prUrl, "--json", "headRefName,isCrossRepository"], { cwd, encoding: "utf-8", timeout: 1e4 });
       return decidePrBranch("github", stdout);
     } catch (err) {
-      log.warn(TAG13, `gh pr view failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
+      log.warn(TAG14, `gh pr view failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
       return decidePrBranch("github", null);
     }
   }
@@ -1099,7 +1584,7 @@ async function resolvePrHeadBranch(prUrl, cwd, provider) {
       const { stdout } = await execFileAsync2()("az", ["repos", "pr", "show", "--id", prId, "--output", "json"], { cwd, encoding: "utf-8", timeout: 1e4 });
       return decidePrBranch("azure", stdout);
     } catch (err) {
-      log.warn(TAG13, `az repos pr show failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
+      log.warn(TAG14, `az repos pr show failed for ${prUrl}: ${err instanceof Error ? err.message : String(err)}`);
       return decidePrBranch("azure", null);
     }
   }
@@ -1127,7 +1612,13 @@ function resolvePrUrl(description, branchName, cwd, provider) {
 }
 function remoteBranchExists(branchName, cwd) {
   try {
-    execFileSync7("git", ["ls-remote", "--exit-code", "origin", `refs/heads/${branchName}`], { cwd, stdio: "pipe" });
+    execFileSync7("git", [
+      ...GIT_NO_HOOKS,
+      "ls-remote",
+      "--exit-code",
+      "origin",
+      `refs/heads/${branchName}`
+    ], { cwd, stdio: "pipe" });
     return true;
   } catch {
     return false;
@@ -1135,24 +1626,24 @@ function remoteBranchExists(branchName, cwd) {
 }
 function pushBranch(branchName, cwd) {
   if (remoteBranchExists(branchName, cwd)) {
-    log.info(TAG13, `Remote branch ${branchName} exists (rework), force-pushing`);
+    log.info(TAG14, `Remote branch ${branchName} exists (rework), force-pushing`);
     let expectedSha = null;
     try {
-      execFileSync7("git", ["fetch", "origin", branchName], {
+      execFileSync7("git", [...GIT_NO_HOOKS, "fetch", "origin", branchName], {
         cwd,
         stdio: "pipe"
       });
-      expectedSha = execFileSync7("git", ["rev-parse", `refs/remotes/origin/${branchName}`], { cwd, encoding: "utf-8" }).trim();
+      expectedSha = execFileSync7("git", [...GIT_NO_HOOKS, "rev-parse", `refs/remotes/origin/${branchName}`], { cwd, encoding: "utf-8" }).trim();
     } catch (err) {
-      log.warn(TAG13, `could not resolve remote tip for ${branchName}, falling back to weak lease: ${err instanceof Error ? err.message : err}`);
+      log.warn(TAG14, `could not resolve remote tip for ${branchName}, falling back to weak lease: ${err instanceof Error ? err.message : err}`);
     }
     const lease = expectedSha ? `--force-with-lease=refs/heads/${branchName}:${expectedSha}` : "--force-with-lease";
-    execFileSync7("git", ["push", lease, "-u", "origin", branchName], {
+    execFileSync7("git", [...GIT_NO_HOOKS, "push", lease, "-u", "origin", branchName], {
       cwd,
       stdio: "pipe"
     });
   } else {
-    execFileSync7("git", ["push", "-u", "origin", branchName], {
+    execFileSync7("git", [...GIT_NO_HOOKS, "push", "-u", "origin", branchName], {
       cwd,
       stdio: "pipe"
     });
@@ -1163,25 +1654,31 @@ function renameRemoteBranch(oldRef, newRef, cwd) {
     return;
   let sha;
   try {
-    sha = execFileSync7("git", ["rev-parse", "HEAD"], {
+    sha = execFileSync7("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd,
       encoding: "utf-8"
     }).trim();
   } catch (err) {
     throw new Error(`renameRemoteBranch: could not resolve HEAD: ${err instanceof Error ? err.message : err}`);
   }
-  log.info(TAG13, `Renaming remote ${oldRef} → ${newRef}`);
-  execFileSync7("git", ["push", "origin", `${sha}:refs/heads/${newRef}`, "--force-with-lease"], { cwd, stdio: "pipe" });
+  log.info(TAG14, `Renaming remote ${oldRef} → ${newRef}`);
+  execFileSync7("git", [
+    ...GIT_NO_HOOKS,
+    "push",
+    "origin",
+    `${sha}:refs/heads/${newRef}`,
+    "--force-with-lease"
+  ], { cwd, stdio: "pipe" });
   try {
-    execFileSync7("git", ["push", "origin", `:refs/heads/${oldRef}`], {
+    execFileSync7("git", [...GIT_NO_HOOKS, "push", "origin", `:refs/heads/${oldRef}`], {
       cwd,
       stdio: "pipe"
     });
   } catch (err) {
-    log.warn(TAG13, `renameRemoteBranch: could not delete old ref ${oldRef}: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG14, `renameRemoteBranch: could not delete old ref ${oldRef}: ${err instanceof Error ? err.message : err}`);
   }
   try {
-    execFileSync7("git", ["branch", "-m", oldRef, newRef], {
+    execFileSync7("git", [...GIT_NO_HOOKS, "branch", "-m", oldRef, newRef], {
       cwd,
       stdio: "pipe"
     });
@@ -1189,7 +1686,7 @@ function renameRemoteBranch(oldRef, newRef, cwd) {
 }
 function getBranchWebUrl(branchName, cwd) {
   try {
-    const remoteUrl = execFileSync7("git", ["remote", "get-url", "origin"], {
+    const remoteUrl = execFileSync7("git", [...GIT_NO_HOOKS, "remote", "get-url", "origin"], {
       cwd,
       encoding: "utf-8"
     }).trim();
@@ -1237,12 +1734,17 @@ function buildPrBody(card, commitLog) {
 }
 function createPullRequest(card, branchName, worktreePath, config, provider, existingPrUrl) {
   if (existingPrUrl) {
-    log.info(TAG13, `Reusing existing PR from card description: ${existingPrUrl}`);
+    log.info(TAG14, `Reusing existing PR from card description: ${existingPrUrl}`);
     return existingPrUrl;
   }
   let commitLog = "";
   try {
-    commitLog = execFileSync7("git", ["log", "--oneline", `origin/${config.worktree.baseBranch}..HEAD`], { cwd: worktreePath, encoding: "utf-8" }).trim();
+    commitLog = execFileSync7("git", [
+      ...GIT_NO_HOOKS,
+      "log",
+      "--oneline",
+      `origin/${config.worktree.baseBranch}..HEAD`
+    ], { cwd: worktreePath, encoding: "utf-8" }).trim();
   } catch {
     commitLog = "(unable to retrieve commit log)";
   }
@@ -1251,7 +1753,7 @@ function createPullRequest(card, branchName, worktreePath, config, provider, exi
   const base = config.worktree.baseBranch;
   const existingUrl = findExistingPr(branchName, worktreePath, provider);
   if (existingUrl) {
-    log.info(TAG13, `PR already exists for ${branchName}, updating body...`);
+    log.info(TAG14, `PR already exists for ${branchName}, updating body...`);
     updateExistingPr(branchName, body, worktreePath, provider);
     return existingUrl;
   }
@@ -1301,13 +1803,13 @@ function createPullRequest(card, branchName, worktreePath, config, provider, exi
         ], { cwd: worktreePath, encoding: "utf-8" }).trim();
         break;
       default:
-        log.warn(TAG13, `No PR CLI for provider "${provider}" — branch pushed but no PR created`);
+        log.warn(TAG14, `No PR CLI for provider "${provider}" — branch pushed but no PR created`);
         return null;
     }
-    log.info(TAG13, `PR created: ${result}`);
+    log.info(TAG14, `PR created: ${result}`);
     return result;
   } catch (err) {
-    log.error(TAG13, `Failed to create PR: ${err instanceof Error ? err.message : err}`);
+    log.error(TAG14, `Failed to create PR: ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -1341,15 +1843,16 @@ function updateExistingPr(branchName, body, worktreePath, provider) {
         execFileSync7("glab", ["mr", "update", branchName, "--description", body], { cwd: worktreePath, stdio: "pipe" });
         break;
     }
-    log.info(TAG13, `Updated existing PR body for ${branchName}`);
+    log.info(TAG14, `Updated existing PR body for ${branchName}`);
   } catch (err) {
-    log.warn(TAG13, `Failed to update PR body: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG14, `Failed to update PR body: ${err instanceof Error ? err.message : err}`);
   }
 }
-var cachedExecFileAsync2, TAG13 = "git-pr", VALID_PR_URL_RE, PR_URL_RE, REVIEWED_SHA_RE, CI_REVIEW_REQUESTED_SHA_RE;
+var cachedExecFileAsync2, TAG14 = "git-pr", VALID_PR_URL_RE, PR_URL_RE, REVIEWED_SHA_RE, CI_REVIEW_REQUESTED_SHA_RE;
 var init_git_pr = __esm(() => {
   init_dist();
   init_log();
+  init_run_containment();
   VALID_PR_URL_RE = /^https:\/\/(github\.com|gitlab\.com|dev\.azure\.com|bitbucket\.org)\//;
   PR_URL_RE = /PR:\s*(https?:\/\/[^\s)]+)/;
   REVIEWED_SHA_RE = /^Reviewed-SHA:\s*([0-9a-f]{7,40})\s*$/im;
@@ -1635,6 +2138,7 @@ class SdkAgentRunner {
       ...this.cfg.settingSources ? { settingSources: this.cfg.settingSources } : {},
       ...this.cfg.mcpServers ? { mcpServers: this.cfg.mcpServers } : {},
       ...this.cfg.strictMcpConfig ? { strictMcpConfig: true } : {},
+      ...this.cfg.sandbox ? { sandbox: this.cfg.sandbox } : {},
       stderr: (data) => {
         this.capturedStderr += data;
       },
@@ -2051,6 +2555,7 @@ class ArtifactCollector {
 }
 // src/ci-failure.ts
 init_log();
+init_run_containment();
 import { execFile, execFileSync } from "node:child_process";
 import { promisify } from "node:util";
 function createExecFileAsync() {
@@ -2078,7 +2583,7 @@ function isPrOnOrigin(prUrl, cwd) {
   if (!prSlug)
     return false;
   try {
-    const remote = execFileSync("git", ["remote", "get-url", "origin"], {
+    const remote = execFileSync("git", [...GIT_NO_HOOKS, "remote", "get-url", "origin"], {
       cwd,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -2216,6 +2721,7 @@ init_dist();
 
 // src/exec-types.ts
 var DEFAULT_METRIC_TIMEOUT_MS = 300000;
+var SANDBOX_STARTUP_GRACE_MS = 60000;
 
 // src/gate-config-error.ts
 init_dist();
@@ -2230,14 +2736,14 @@ var MAX_METRIC_TIMEOUT_MS = 900000;
 var METRIC_SIGINT_GRACE_MS = 2000;
 var METRIC_SIGTERM_GRACE_MS = 3000;
 var STDIO_DRAIN_GRACE_MS = 500;
-function parseParseMode(parse) {
-  if (typeof parse !== "string" || parse.length === 0) {
+function parseParseMode(parse2) {
+  if (typeof parse2 !== "string" || parse2.length === 0) {
     return { kind: "invalid", reason: "`parse` must be a non-empty string" };
   }
-  if (parse === "number")
+  if (parse2 === "number")
     return { kind: "number" };
-  if (parse.startsWith("json:")) {
-    const path = parse.slice("json:".length).trim();
+  if (parse2.startsWith("json:")) {
+    const path = parse2.slice("json:".length).trim();
     if (!path) {
       return { kind: "invalid", reason: '`parse` "json:" is missing a path' };
     }
@@ -2245,7 +2751,7 @@ function parseParseMode(parse) {
   }
   return {
     kind: "invalid",
-    reason: `unknown \`parse\` mode "${parse}" (expected "number" or "json:<path>")`
+    reason: `unknown \`parse\` mode "${parse2}" (expected "number" or "json:<path>")`
   };
 }
 function parseMetricValue(mode, stdout) {
@@ -2291,7 +2797,7 @@ function parseMetricValue(mode, stdout) {
   return { ok: true, value: resolved };
 }
 function runMetricCommand(args) {
-  return new Promise((resolve, reject) => {
+  return new Promise((resolve2, reject) => {
     let child;
     try {
       child = spawnInGroup(args.command, args.args, {
@@ -2322,7 +2828,7 @@ function runMetricCommand(args) {
       if (failure)
         reject(failure);
       else
-        resolve(Buffer.concat(chunks).toString("utf8"));
+        resolve2(Buffer.concat(chunks).toString("utf8"));
     };
     const killTree = (reason) => {
       if (settled || killReason)
@@ -2470,123 +2976,20 @@ function describeRunFailure(err, timeoutMs) {
 function truncate(value, max) {
   return value.length <= max ? value : `${value.slice(0, max)}…[truncated]`;
 }
-// src/confine-to-repo.ts
-import { realpathSync } from "node:fs";
-import { dirname, isAbsolute, parse, resolve, sep } from "node:path";
-var READ_PATH_ARGS = {
-  Read: ["file_path", "path", "notebook_path"],
-  Grep: ["path"],
-  Glob: ["path"]
-};
-var WRITE_PATH_ARGS = {
-  Write: ["file_path"],
-  Edit: ["file_path"],
-  MultiEdit: ["file_path"],
-  NotebookEdit: ["notebook_path"]
-};
-var CONFINED_READ_TOOLS = Object.freeze(Object.keys(READ_PATH_ARGS));
-var CONFINED_WRITE_TOOLS = Object.freeze([
-  ...Object.keys(READ_PATH_ARGS),
-  ...Object.keys(WRITE_PATH_ARGS).filter((t) => t !== "MultiEdit")
-]);
-var PATTERN_ARG_BY_TOOL = {
-  Glob: ["pattern"],
-  Grep: ["glob"]
-};
-function isGitMetadata(repoRoot, candidate) {
-  const rel = candidate.startsWith(repoRoot) ? candidate.slice(repoRoot.length) : candidate;
-  return rel.split(/[\\/]/).some((segment) => segment.toLowerCase() === ".git");
-}
-function patternEscapes(pattern) {
-  if (isAbsolute(pattern))
-    return true;
-  if (/[{}[\]~()!+@]/.test(pattern))
-    return true;
-  return pattern.split(/[\\/]/).some((segment) => segment === "..");
-}
-function pathArgsFor(mode) {
-  return mode === "write" ? { ...READ_PATH_ARGS, ...WRITE_PATH_ARGS } : READ_PATH_ARGS;
-}
-function realPathOrNearest(p) {
-  const abs = isAbsolute(p) ? p : resolve(p);
-  const { root } = parse(abs);
-  let real = root;
-  for (const part of abs.slice(root.length).split(sep)) {
-    if (part === "" || part === ".")
-      continue;
-    if (part === "..") {
-      real = dirname(real);
-      continue;
-    }
-    const next = real.endsWith(sep) ? real + part : real + sep + part;
-    try {
-      real = realpathSync(next);
-    } catch {
-      real = next;
-    }
-  }
-  return real;
-}
-function isInsideTree(root, target) {
-  const normalizedRoot = realPathOrNearest(root);
-  const normalizedTarget = realPathOrNearest(target);
-  if (normalizedTarget === normalizedRoot)
-    return true;
-  return normalizedTarget.startsWith(normalizedRoot + sep);
-}
-function decideConfinedTool(repoRoot, toolName, input, mode = "read") {
-  const pathArgs = pathArgsFor(mode)[toolName];
-  if (!pathArgs) {
-    return {
-      behavior: "deny",
-      message: `${toolName} is not available to this run.`
-    };
-  }
-  const verb = toolName in WRITE_PATH_ARGS ? "write" : "read";
-  for (const key of PATTERN_ARG_BY_TOOL[toolName] ?? []) {
-    const value = input[key];
-    if (typeof value !== "string" || value.length === 0)
-      continue;
-    if (patternEscapes(value)) {
-      return {
-        behavior: "deny",
-        message: `${toolName} patterns must stay inside the repository — no absolute path and no "..". Refused: ${value}`
-      };
-    }
-  }
-  for (const key of pathArgs) {
-    const value = input[key];
-    if (typeof value !== "string" || value.length === 0)
-      continue;
-    const candidate = isAbsolute(value) ? value : `${repoRoot}${sep}${value}`;
-    if (isGitMetadata(repoRoot, candidate)) {
-      return {
-        behavior: "deny",
-        message: `${toolName} may not touch the repository's git metadata. Refused: ${value}`
-      };
-    }
-    if (!isInsideTree(repoRoot, candidate)) {
-      return {
-        behavior: "deny",
-        message: `${toolName} may only ${verb} inside the repository. Refused: ${value}`
-      };
-    }
-  }
-  return { behavior: "allow" };
-}
-function confineToRepo(repoRoot, mode = "read") {
-  return async (toolName, input) => decideConfinedTool(repoRoot, toolName, input, mode);
-}
+
+// src/index.ts
+init_confine_to_repo();
+
 // src/gate-collectors.ts
 init_dist();
 init_log();
 
 // src/oracle-collector.ts
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 init_log();
 
 // src/oracle.ts
-import { lstatSync, readFileSync, statSync } from "node:fs";
+import { lstatSync, readFileSync as readFileSync2, statSync } from "node:fs";
 import {
   chmod,
   lstat,
@@ -2596,13 +2999,13 @@ import {
   rm,
   writeFile
 } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { dirname as dirname2, isAbsolute as isAbsolute2, join, resolve as resolve2, sep as sep2 } from "node:path";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join2, resolve as resolve2, sep as sep2 } from "node:path";
 import { StringDecoder } from "node:string_decoder";
 init_log();
 var TAG5 = "oracle";
 async function resolveContained(repoPath, relativePath) {
-  if (isAbsolute2(relativePath)) {
+  if (isAbsolute3(relativePath)) {
     throw new Error(`refusing to place an oracle at an absolute path: ${relativePath}`);
   }
   if (relativePath === "" || relativePath === ".") {
@@ -2625,7 +3028,7 @@ async function resolveContained(repoPath, relativePath) {
 }
 async function place(repoPath, oracle) {
   const target = await resolveContained(repoPath, oracle.path);
-  await mkdir(dirname2(target), { recursive: true });
+  await mkdir(dirname3(target), { recursive: true });
   await writeFile(target, oracle.content, "utf8");
 }
 async function remove(repoPath, oracle) {
@@ -2733,8 +3136,8 @@ function argvPath(path) {
 }
 async function runHeldOracle(repoPath, oracle, timeoutMs = DEFAULT_METRIC_TIMEOUT_MS) {
   const spec = resolveOracleRunnerSpec(oracle);
-  const reportDir = await mkdtemp(join(tmpdir(), reportDirPrefix()));
-  const reportPath = join(reportDir, spec.report.file);
+  const reportDir = await mkdtemp(join2(tmpdir2(), reportDirPrefix()));
+  const reportPath = join2(reportDir, spec.report.file);
   try {
     return await spawnHeldOracle(spec, repoPath, oracle, reportPath, timeoutMs);
   } finally {
@@ -2745,7 +3148,7 @@ function reportDirPrefix() {
   return "harmony-oracle-report-";
 }
 function assertUntampered(reportPath) {
-  const dir = statSync(dirname2(reportPath));
+  const dir = statSync(dirname3(reportPath));
   if ((dir.mode & 511) !== 448) {
     throw new Error(`the oracle report directory's mode changed to ${(dir.mode & 511).toString(8)} — refusing the report`);
   }
@@ -2808,7 +3211,7 @@ ${output}` : output;
     const captureReport = () => {
       try {
         assertUntampered(reportPath);
-        report = spec.report.parse(readFileSync(reportPath, "utf8"));
+        report = spec.report.parse(readFileSync2(reportPath, "utf8"));
       } catch (err) {
         report = null;
         const message = err instanceof Error ? err.message : String(err);
@@ -2926,7 +3329,7 @@ class HeldOracleCollector {
   async runHeld(oracle) {
     const identity = {
       oracleId: oracle.id ?? null,
-      contentHash: createHash("sha256").update(oracle.content).digest("hex")
+      contentHash: createHash2("sha256").update(oracle.content).digest("hex")
     };
     await this.deps.place(this.deps.repoPath, oracle);
     try {
@@ -3037,11 +3440,12 @@ function errText(err) {
 }
 
 // src/verification.ts
-init_log();
 import { execFileSync as execFileSync5, spawn as spawn2 } from "node:child_process";
+init_log();
 
 // src/pm.ts
 init_log();
+init_run_containment();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { existsSync } from "node:fs";
 var TAG7 = "pm";
@@ -3051,7 +3455,7 @@ function detectPackageManager() {
     return cached;
   let repoRoot;
   try {
-    repoRoot = execFileSync2("git", ["rev-parse", "--show-toplevel"], {
+    repoRoot = execFileSync2("git", [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"], {
       encoding: "utf-8"
     }).trim();
   } catch {
@@ -3094,7 +3498,7 @@ function spawnRunArgs(script, ...extra) {
 // src/project-type.ts
 init_log();
 import { execFileSync as execFileSync3 } from "node:child_process";
-import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { existsSync as existsSync2, readdirSync, readFileSync as readFileSync3 } from "node:fs";
 var TAG8 = "project-type";
 var _cache = new Map;
 function _resetCache() {
@@ -3197,7 +3601,7 @@ var NPM_PLACEHOLDER_TEST = /no test specified/i;
 function hasNodeTestScript(dir) {
   let script;
   try {
-    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync3(`${dir}/package.json`, "utf-8"));
     script = pkg.scripts?.test;
   } catch (err) {
     log.warn(TAG8, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
@@ -3214,7 +3618,7 @@ function hasNodeTestScript(dir) {
 function firstNodeScript(dir, candidates) {
   let scripts;
   try {
-    const pkg = JSON.parse(readFileSync2(`${dir}/package.json`, "utf-8"));
+    const pkg = JSON.parse(readFileSync3(`${dir}/package.json`, "utf-8"));
     scripts = pkg.scripts ?? {};
   } catch (err) {
     log.warn(TAG8, `Could not read package.json in ${dir}: ${err instanceof Error ? err.message : err}`);
@@ -3269,10 +3673,108 @@ function resolveXcodeScheme(pt) {
   }
 }
 
+// src/repair-sandbox.ts
+init_log();
+import { randomUUID } from "node:crypto";
+import { promisify as promisify2 } from "node:util";
+var TAG9 = "repair-sandbox";
+async function dockerExec(argv, opts) {
+  const { execFile: execFile2 } = await import("node:child_process");
+  return promisify2(execFile2)("docker", argv, {
+    encoding: "utf-8",
+    ...opts
+  });
+}
+var MAX_OUTPUT_BUFFER2 = 20971520;
+var PROBE_TIMEOUT_MS = 1e4;
+var SANDBOX_MOUNT = "/repo";
+var SANDBOX_MEMORY = "4g";
+var SANDBOX_PIDS = "512";
+var dockerProbe = null;
+async function sandboxAvailable() {
+  if (dockerProbe === true)
+    return true;
+  try {
+    await dockerExec(["version", "--format", "{{.Server.Version}}"], {
+      timeout: PROBE_TIMEOUT_MS
+    });
+    dockerProbe = true;
+  } catch {
+    dockerProbe = false;
+  }
+  return dockerProbe;
+}
+function __resetSandboxProbe() {
+  dockerProbe = null;
+}
+async function removeContainer(name) {
+  try {
+    await dockerExec(["rm", "--force", name], { timeout: PROBE_TIMEOUT_MS });
+    log.warn(TAG9, `removed the timed-out sandbox container ${name}`);
+  } catch {}
+}
+function sandboxRunArgs(image, worktree, command, name) {
+  return [
+    "run",
+    "--rm",
+    ...name ? ["--name", name] : [],
+    "--network=none",
+    "--cap-drop=ALL",
+    "--security-opt=no-new-privileges",
+    `--memory=${SANDBOX_MEMORY}`,
+    `--pids-limit=${SANDBOX_PIDS}`,
+    ...typeof process.getuid === "function" && typeof process.getgid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`] : [],
+    "--env",
+    "HOME=/tmp",
+    "--volume",
+    `${worktree}:${SANDBOX_MOUNT}`,
+    "--workdir",
+    SANDBOX_MOUNT,
+    "--entrypoint",
+    command.cmd,
+    image,
+    ...command.args
+  ];
+}
+async function runInSandbox(args) {
+  const name = `harmony-repair-${randomUUID()}`;
+  const argv = sandboxRunArgs(args.image, args.worktree, args.command, name);
+  log.info(TAG9, `sandbox: ${args.command.cmd} ${args.command.args.join(" ")} (image ${args.image})`);
+  try {
+    const { stdout } = await dockerExec(argv, {
+      timeout: args.timeoutMs,
+      maxBuffer: MAX_OUTPUT_BUFFER2
+    });
+    return { passed: true, output: stdout ?? "" };
+  } catch (err) {
+    const e = err;
+    const output = `${e.stdout ?? ""}${e.stderr ?? ""}`;
+    if (typeof e.code !== "number") {
+      const timedOut = e.killed === true || e.signal != null;
+      if (timedOut)
+        await removeContainer(name);
+      return {
+        passed: false,
+        output,
+        sandboxError: timedOut ? `the sandbox timed out after ${args.timeoutMs}ms` : `the sandbox did not run: ${e.message ?? "unknown error"}`
+      };
+    }
+    if (e.code === 125) {
+      return {
+        passed: false,
+        output,
+        sandboxError: `the sandbox could not start (image "${args.image}" missing or unusable)`
+      };
+    }
+    return { passed: false, output };
+  }
+}
+
 // src/revert-guard.ts
 init_log();
+init_run_containment();
 import { execFileSync as execFileSync4 } from "node:child_process";
-var TAG9 = "revert-guard";
+var TAG10 = "revert-guard";
 var TEST_FILE = /(?:^|\/)__tests__\/|\.(?:test|spec)\.[cm]?[jt]sx?$/;
 function isTestFile(path) {
   return TEST_FILE.test(path);
@@ -3282,21 +3784,27 @@ function filterTestFiles(paths) {
 }
 function refetchBase(worktreePath, baseBranch) {
   try {
-    execFileSync4("git", ["fetch", "origin", baseBranch], {
+    execFileSync4("git", [...GIT_NO_HOOKS, "fetch", "origin", baseBranch], {
       cwd: worktreePath,
       stdio: "pipe"
     });
   } catch {
-    log.warn(TAG9, "Failed to re-fetch base for revert guard — using last fetch");
+    log.warn(TAG10, "Failed to re-fetch base for revert guard — using last fetch");
   }
 }
 function listDeletedFilesAgainstBase(worktreePath, baseBranch) {
   try {
-    const out = execFileSync4("git", ["diff", "--diff-filter=D", "--name-only", `origin/${baseBranch}...HEAD`], { cwd: worktreePath, encoding: "utf-8" });
+    const out = execFileSync4("git", [
+      ...GIT_NO_HOOKS,
+      "diff",
+      "--diff-filter=D",
+      "--name-only",
+      `origin/${baseBranch}...HEAD`
+    ], { cwd: worktreePath, encoding: "utf-8" });
     return out.split(`
 `).map((l) => l.trim()).filter((l) => l.length > 0);
   } catch (err) {
-    log.warn(TAG9, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG10, `Failed to list deleted files: ${err instanceof Error ? err.message : err}`);
     return [];
   }
 }
@@ -3306,8 +3814,9 @@ function findDeletedTestFiles(worktreePath, baseBranch) {
 }
 
 // src/verification.ts
-var TAG10 = "verification";
-var MAX_OUTPUT_BUFFER2 = 64 * 1024 * 1024;
+init_run_containment();
+var TAG11 = "verification";
+var MAX_OUTPUT_BUFFER3 = 64 * 1024 * 1024;
 async function runVerification(worktreePath, config, workerId) {
   const result = {
     passed: true,
@@ -3317,133 +3826,163 @@ async function runVerification(worktreePath, config, workerId) {
     reviewFindings: [],
     revertWarnings: []
   };
+  const sandbox = verificationSandbox(config);
   if (config.verification.revertGuard) {
-    log.info(TAG10, `[worker:${workerId}] Checking for reverted merged work...`);
+    log.info(TAG11, `[worker:${workerId}] Checking for reverted merged work...`);
     const deletedTests = findDeletedTestFiles(worktreePath, config.worktree.baseBranch);
     if (deletedTests.length > 0) {
       result.revertWarnings = deletedTests.map((f) => `Branch deletes test file '${f}' relative to current ${config.worktree.baseBranch} — ` + "likely an accidental revert of already-merged work. Restore the test or rebase on current main.");
-      log.warn(TAG10, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Revert guard tripped: ${deletedTests.length} deleted test file(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Revert guard passed`);
+      log.info(TAG11, `[worker:${workerId}] Revert guard passed`);
     }
   }
   if (config.verification.build) {
-    log.info(TAG10, `[worker:${workerId}] Running build...`);
-    result.buildErrors = runBuild(worktreePath, config.verification.timeout);
+    log.info(TAG11, `[worker:${workerId}] Running build...`);
+    result.buildErrors = await runBuild(worktreePath, config.verification.timeout, sandbox);
     if (result.buildErrors.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Build failed with ${result.buildErrors.length} error(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Build passed`);
+      log.info(TAG11, `[worker:${workerId}] Build passed`);
     }
   }
   if (config.verification.test && result.buildErrors.length === 0) {
-    log.info(TAG10, `[worker:${workerId}] Running tests...`);
-    result.testFailures = runTests(worktreePath, config.verification.testTimeout);
+    log.info(TAG11, `[worker:${workerId}] Running tests...`);
+    result.testFailures = await runTests(worktreePath, config.verification.testTimeout, sandbox);
     if (result.testFailures.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Tests failed with ${result.testFailures.length} failure(s)`);
       result.passed = false;
     } else {
-      log.info(TAG10, `[worker:${workerId}] Tests passed`);
+      log.info(TAG11, `[worker:${workerId}] Tests passed`);
     }
   }
   if (config.verification.lint) {
-    log.info(TAG10, `[worker:${workerId}] Running lint...`);
-    result.lintWarnings = runLint(worktreePath, config.verification.timeout);
+    log.info(TAG11, `[worker:${workerId}] Running lint...`);
+    result.lintWarnings = await runLint(worktreePath, config.verification.timeout, sandbox);
     if (result.lintWarnings.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Lint found ${result.lintWarnings.length} issue(s)`);
     } else {
-      log.info(TAG10, `[worker:${workerId}] Lint passed`);
+      log.info(TAG11, `[worker:${workerId}] Lint passed`);
     }
   }
   if (config.verification.deepReview) {
-    log.info(TAG10, `[worker:${workerId}] Running deep review...`);
+    log.info(TAG11, `[worker:${workerId}] Running deep review...`);
     result.reviewFindings = await runDeepReview(worktreePath, config, workerId);
     if (result.reviewFindings.length > 0) {
-      log.warn(TAG10, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
+      log.warn(TAG11, `[worker:${workerId}] Deep review found ${result.reviewFindings.length} finding(s)`);
     } else {
-      log.info(TAG10, `[worker:${workerId}] Deep review passed`);
+      log.info(TAG11, `[worker:${workerId}] Deep review passed`);
     }
   }
   return result;
 }
-function runBuild(worktreePath, timeout) {
-  const command = buildCommand(worktreePath);
-  if (!command) {
-    log.warn(TAG10, `No known build toolchain for ${worktreePath} — skipping build`);
-    return [];
+function verificationSandbox(config) {
+  const image = config.verification.sandboxImage?.trim();
+  if (!image)
+    return;
+  return { image };
+}
+async function execStep(command, args) {
+  const { worktreePath, timeout } = args;
+  const sandbox = args.sandbox?.image.trim() ? args.sandbox : undefined;
+  if (sandbox) {
+    if (!await sandboxAvailable()) {
+      return {
+        ok: false,
+        sandboxError: `verification.sandboxImage is set to "${sandbox.image}" but no container runtime answered — ` + "start Docker or unset the image to verify on the host"
+      };
+    }
+    const result = await runInSandbox({
+      image: sandbox.image,
+      worktree: worktreePath,
+      command,
+      timeoutMs: timeout + SANDBOX_STARTUP_GRACE_MS
+    });
+    if (result.sandboxError) {
+      return { ok: false, sandboxError: result.sandboxError };
+    }
+    if (result.passed)
+      return { ok: true };
+    return { ok: false, err: { stdout: result.output, stderr: "" } };
   }
   try {
     execFileSync5(command.cmd, command.args, {
       cwd: worktreePath,
       timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER3,
+      env: containedEnv()
     });
-    return [];
+    return { ok: true };
   } catch (err) {
-    return parseErrorOutput(err);
+    return { ok: false, err };
   }
 }
-function runTests(worktreePath, timeout) {
+async function runBuild(worktreePath, timeout, sandbox) {
+  const command = buildCommand(worktreePath);
+  if (!command) {
+    log.warn(TAG11, `No known build toolchain for ${worktreePath} — skipping build`);
+    return [];
+  }
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
+    return [];
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Build not verified: ${outcome.sandboxError}`);
+    return [`Build did not run: ${outcome.sandboxError}`];
+  }
+  return parseErrorOutput(outcome.err);
+}
+async function runTests(worktreePath, timeout, sandbox) {
   const command = testCommand(worktreePath);
   if (!command) {
-    log.warn(TAG10, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
+    log.warn(TAG11, `No test command for detected toolchain in ${worktreePath} — skipping tests`);
     return [];
   }
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
-    });
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
     return [];
-  } catch (err) {
-    const output = combineOutput(err);
-    log.warn(TAG10, `Test run failed:
-${output.slice(-4000) || "(no output captured)"}`);
-    return parseTestFailures(err, timeout);
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Tests not verified: ${outcome.sandboxError}`);
+    return [`Test run did not happen: ${outcome.sandboxError}`];
   }
+  const output = combineOutput(outcome.err);
+  log.warn(TAG11, `Test run failed:
+${output.slice(-4000) || "(no output captured)"}`);
+  return parseTestFailures(outcome.err, timeout);
 }
-function runFormatFix(worktreePath, timeout, workerId) {
+async function runFormatFix(worktreePath, timeout, workerId, sandbox) {
   const command = formatFixCommand(worktreePath);
   if (!command)
     return;
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
-    });
-    log.info(TAG10, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
-  } catch (err) {
-    log.warn(TAG10, `[worker:${workerId}] Auto-format step exited non-zero (non-fatal): ${err instanceof Error ? err.message : String(err)}`);
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok) {
+    log.info(TAG11, `[worker:${workerId}] Auto-formatted worktree before commit/push`);
+    return;
   }
+  const why = outcome.sandboxError ? outcome.sandboxError : outcome.err instanceof Error ? outcome.err.message : String(outcome.err);
+  log.warn(TAG11, `[worker:${workerId}] Auto-format step did not complete (non-fatal): ${why}`);
 }
-function runLint(worktreePath, timeout) {
+async function runLint(worktreePath, timeout, sandbox) {
   const command = lintCommand(worktreePath);
   if (!command) {
-    log.info(TAG10, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
+    log.info(TAG11, `No lint step for detected toolchain in ${worktreePath} — skipping lint`);
     return [];
   }
-  try {
-    execFileSync5(command.cmd, command.args, {
-      cwd: worktreePath,
-      timeout,
-      stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
-    });
+  const outcome = await execStep(command, { worktreePath, timeout, sandbox });
+  if (outcome.ok)
     return [];
-  } catch (err) {
-    return parseErrorOutput(err);
+  if (outcome.sandboxError) {
+    log.error(TAG11, `Lint not verified: ${outcome.sandboxError}`);
+    return [`Lint did not run: ${outcome.sandboxError}`];
   }
+  return parseErrorOutput(outcome.err);
 }
 async function runDeepReview(worktreePath, config, workerId) {
   if (!supportsDevServer(worktreePath)) {
-    log.info(TAG10, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
+    log.info(TAG11, `[worker:${workerId}] Detected non-web toolchain — skipping deep review`);
     return [];
   }
   const port = config.verification.devServerBasePort + workerId;
@@ -3452,22 +3991,23 @@ async function runDeepReview(worktreePath, config, workerId) {
     const [cmd, args] = spawnRunArgs("dev", "--port", String(port));
     devServer = spawn2(cmd, args, {
       cwd: worktreePath,
-      stdio: ["ignore", "pipe", "pipe"]
+      stdio: ["ignore", "pipe", "pipe"],
+      env: containedEnv()
     });
     try {
       await waitForDevServer(devServer, 30000);
       await probeDevServer(port);
     } catch (err) {
-      log.error(TAG10, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG11, `Dev server did not become ready: ${err instanceof Error ? err.message : err}`);
       return [];
     }
     let diff = "";
     try {
-      diff = execFileSync5("git", ["diff", `origin/${config.worktree.baseBranch}..HEAD`], {
+      diff = execFileSync5("git", [...GIT_NO_HOOKS, "diff", `origin/${config.worktree.baseBranch}..HEAD`], {
         cwd: worktreePath,
         encoding: "utf-8",
         timeout: 30000,
-        maxBuffer: MAX_OUTPUT_BUFFER2
+        maxBuffer: MAX_OUTPUT_BUFFER3
       });
     } catch {
       diff = "(unable to retrieve diff)";
@@ -3484,14 +4024,16 @@ async function runDeepReview(worktreePath, config, workerId) {
       "```"
     ].join(`
 `);
-    const leanSources = config.claude.leanSettingSources;
     const output = execFileSync5("claude", [
       "--print",
       "--model",
       "sonnet",
       "--max-turns",
       "10",
-      ...leanSources ? ["--setting-sources", leanSources] : [],
+      ...implementRunContainmentCliArgs({
+        worktree: worktreePath,
+        readOnly: true
+      }),
       "--",
       reviewPrompt
     ], {
@@ -3499,11 +4041,12 @@ async function runDeepReview(worktreePath, config, workerId) {
       encoding: "utf-8",
       timeout: config.verification.timeout,
       stdio: "pipe",
-      maxBuffer: MAX_OUTPUT_BUFFER2
+      maxBuffer: MAX_OUTPUT_BUFFER3,
+      env: containedEnv()
     });
     return parseReviewFindings(output);
   } catch (err) {
-    log.error(TAG10, `Deep review failed: ${err instanceof Error ? err.message : err}`);
+    log.error(TAG11, `Deep review failed: ${err instanceof Error ? err.message : err}`);
     return [];
   } finally {
     if (devServer && !devServer.killed) {
@@ -3529,7 +4072,6 @@ function attemptAutoFix(worktreePath, config, errors) {
     "```"
   ].join(`
 `);
-  const leanSources = config.claude.leanSettingSources;
   const args = [
     "--print",
     "--model",
@@ -3538,16 +4080,17 @@ function attemptAutoFix(worktreePath, config, errors) {
     "50",
     "--allowedTools",
     "Bash,Read,Write,Edit,Glob,Grep",
-    ...leanSources ? ["--setting-sources", leanSources] : [],
+    ...implementRunContainmentCliArgs({ worktree: worktreePath }),
     "--",
     fixPrompt
   ];
-  log.info(TAG10, "Spawning Claude for auto-fix...");
+  log.info(TAG11, "Spawning Claude for auto-fix...");
   execFileSync5("claude", args, {
     cwd: worktreePath,
     timeout: config.verification.timeout,
     stdio: "pipe",
-    maxBuffer: MAX_OUTPUT_BUFFER2
+    maxBuffer: MAX_OUTPUT_BUFFER3,
+    env: containedEnv()
   });
 }
 async function reportFindings(client, cardId, result, recovery) {
@@ -3580,7 +4123,7 @@ async function reportFindings(client, cardId, result, recovery) {
     try {
       await client.createSubtask(cardId, title);
     } catch (err) {
-      log.error(TAG10, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
+      log.error(TAG11, `Failed to create subtask: ${err instanceof Error ? err.message : err}`);
     }
   }));
   if (overflow > 0) {
@@ -3588,7 +4131,7 @@ async function reportFindings(client, cardId, result, recovery) {
       await client.createSubtask(cardId, `...and ${overflow} more issues`);
     } catch {}
   }
-  log.info(TAG10, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
+  log.info(TAG11, `Reported ${Math.min(items.length, maxSubtasks)} finding(s) as subtasks on card ${cardId}`);
 }
 function combineOutput(err) {
   const stderr = err?.stderr?.toString() ?? "";
@@ -3621,7 +4164,7 @@ function parseTestFailures(err, timeout) {
   }
   if (e?.code === "ENOBUFS") {
     return [
-      `Test output exceeded the ${MAX_OUTPUT_BUFFER2 / (1024 * 1024)}MB capture limit and the run was killed — ` + "the suite's real result is unknown. Quieten the reporter or raise the limit."
+      `Test output exceeded the ${MAX_OUTPUT_BUFFER3 / (1024 * 1024)}MB capture limit and the run was killed — ` + "the suite's real result is unknown. Quieten the reporter or raise the limit."
     ];
   }
   const combined = combineOutput(err);
@@ -3712,7 +4255,7 @@ async function probeDevServer(port, timeoutMs = 5000) {
 }
 
 // src/gate-collectors.ts
-var TAG11 = "gate-collectors";
+var TAG12 = "gate-collectors";
 async function resolveStageGate(client, card) {
   const currentStage = card.current_stage;
   const playbookId = card.playbook_id;
@@ -3730,7 +4273,7 @@ async function resolveStageGate(client, card) {
       return null;
     return { stage: resolution.stage, gate };
   } catch (err) {
-    log.warn(TAG11, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
+    log.warn(TAG12, `resolveStageGate failed for stage "${currentStage}": ${err instanceof Error ? err.message : err}`);
     return null;
   }
 }
@@ -3765,8 +4308,8 @@ class BuildGreenCollector {
   async collect(_context) {
     const doBuild = this.deps.runBuild ?? runBuild;
     const doLint = this.deps.runLint ?? runLint;
-    const buildErrors = doBuild(this.deps.worktreePath, this.deps.buildTimeout);
-    const lintWarnings = doLint(this.deps.worktreePath, this.deps.lintTimeout);
+    const buildErrors = await doBuild(this.deps.worktreePath, this.deps.buildTimeout, this.deps.sandbox);
+    const lintWarnings = await doLint(this.deps.worktreePath, this.deps.lintTimeout, this.deps.sandbox);
     const buildPassed = buildErrors.length === 0;
     const lintPassed = lintWarnings.length === 0;
     const result = buildPassed ? "passed" : "failed";
@@ -3862,7 +4405,7 @@ function buildGateCollectorRegistry(deps) {
 async function collectGateEvidence(registry, context) {
   const collector = registry[context.gate.kind];
   if (!collector) {
-    log.info(TAG11, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
+    log.info(TAG12, `No collector for gate kind "${context.gate.kind}" — reporting blocked`);
     return {
       result: "blocked",
       structured: {
@@ -3874,14 +4417,15 @@ async function collectGateEvidence(registry, context) {
     return await collector.collect(context);
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
-    log.warn(TAG11, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
+    log.warn(TAG12, `Collector for "${context.gate.kind}" threw: ${msg} — reporting blocked`);
     return { result: "blocked", structured: { error: msg } };
   }
 }
 // src/git-diff-stat.ts
 init_log();
+init_run_containment();
 import { execFileSync as execFileSync6 } from "node:child_process";
-var TAG12 = "git-diff-stat";
+var TAG13 = "git-diff-stat";
 var MAX_CHANGED_FILES = 30;
 function parseNumstat(raw, maxFiles = MAX_CHANGED_FILES) {
   const files = [];
@@ -3960,10 +4504,10 @@ function formatDiffSummary(diff, maxFiles = 100) {
 }
 function captureDiffStat(worktreePath, baseBranch, maxFiles = MAX_CHANGED_FILES) {
   try {
-    const raw = execFileSync6("git", ["diff", "--numstat", `${baseBranch}...HEAD`], { cwd: worktreePath, encoding: "utf-8", timeout: 30000 });
+    const raw = execFileSync6("git", [...GIT_NO_HOOKS, "diff", "--numstat", `${baseBranch}...HEAD`], { cwd: worktreePath, encoding: "utf-8", timeout: 30000 });
     return parseNumstat(raw, maxFiles);
   } catch (err) {
-    log.warn(TAG12, "git diff --numstat failed", {
+    log.warn(TAG13, "git diff --numstat failed", {
       event: "diff_stat_failed",
       error: err instanceof Error ? err.message : String(err)
     });
@@ -3976,7 +4520,7 @@ init_git_pr();
 
 // src/harmony-client.ts
 init_log();
-var TAG14 = "harmony-client";
+var TAG15 = "harmony-client";
 function readClientConfig(env) {
   const apiUrl = env.HARMONY_API_URL?.trim();
   const apiKey = env.HARMONY_API_KEY?.trim();
@@ -4028,7 +4572,7 @@ class HarmonyClient {
       purpose: "gate_evaluation"
     });
     if (!response.ok) {
-      log.warn(TAG14, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
+      log.warn(TAG15, `Oracle fetch for stage ${stageId} returned ${response.status} — no oracle read, the gate will report blocked`);
       return null;
     }
     const body = await response.json();
@@ -4108,150 +4652,14 @@ function relayAgentEvent(draft) {
   }
   return { type: "agent_event", event: draft };
 }
-// src/repair-sandbox.ts
-init_log();
-import { randomUUID } from "node:crypto";
-import { promisify as promisify3 } from "node:util";
-var TAG15 = "repair-sandbox";
-async function dockerExec(argv, opts) {
-  const { execFile: execFile3 } = await import("node:child_process");
-  return promisify3(execFile3)("docker", argv, {
-    encoding: "utf-8",
-    ...opts
-  });
-}
-var MAX_OUTPUT_BUFFER3 = 20971520;
-var PROBE_TIMEOUT_MS = 1e4;
-var SANDBOX_MOUNT = "/repo";
-var SANDBOX_MEMORY = "4g";
-var SANDBOX_PIDS = "512";
-var dockerProbe = null;
-async function sandboxAvailable() {
-  if (dockerProbe === true)
-    return true;
-  try {
-    await dockerExec(["version", "--format", "{{.Server.Version}}"], {
-      timeout: PROBE_TIMEOUT_MS
-    });
-    dockerProbe = true;
-  } catch {
-    dockerProbe = false;
-  }
-  return dockerProbe;
-}
-function __resetSandboxProbe() {
-  dockerProbe = null;
-}
-async function removeContainer(name) {
-  try {
-    await dockerExec(["rm", "--force", name], { timeout: PROBE_TIMEOUT_MS });
-    log.warn(TAG15, `removed the timed-out sandbox container ${name}`);
-  } catch {}
-}
-function sandboxRunArgs(image, worktree, command, name) {
-  return [
-    "run",
-    "--rm",
-    ...name ? ["--name", name] : [],
-    "--network=none",
-    "--cap-drop=ALL",
-    "--security-opt=no-new-privileges",
-    `--memory=${SANDBOX_MEMORY}`,
-    `--pids-limit=${SANDBOX_PIDS}`,
-    ...typeof process.getuid === "function" && typeof process.getgid === "function" ? ["--user", `${process.getuid()}:${process.getgid()}`] : [],
-    "--env",
-    "HOME=/tmp",
-    "--volume",
-    `${worktree}:${SANDBOX_MOUNT}`,
-    "--workdir",
-    SANDBOX_MOUNT,
-    "--entrypoint",
-    command.cmd,
-    image,
-    ...command.args
-  ];
-}
-async function runInSandbox(args) {
-  const name = `harmony-repair-${randomUUID()}`;
-  const argv = sandboxRunArgs(args.image, args.worktree, args.command, name);
-  log.info(TAG15, `sandbox: ${args.command.cmd} ${args.command.args.join(" ")} (image ${args.image})`);
-  try {
-    const { stdout } = await dockerExec(argv, {
-      timeout: args.timeoutMs,
-      maxBuffer: MAX_OUTPUT_BUFFER3
-    });
-    return { passed: true, output: stdout ?? "" };
-  } catch (err) {
-    const e = err;
-    const output = `${e.stdout ?? ""}${e.stderr ?? ""}`;
-    if (typeof e.code !== "number") {
-      const timedOut = e.killed === true || e.signal != null;
-      if (timedOut)
-        await removeContainer(name);
-      return {
-        passed: false,
-        output,
-        sandboxError: timedOut ? `the sandbox timed out after ${args.timeoutMs}ms` : `the sandbox did not run: ${e.message ?? "unknown error"}`
-      };
-    }
-    if (e.code === 125) {
-      return {
-        passed: false,
-        output,
-        sandboxError: `the sandbox could not start (image "${args.image}" missing or unusable)`
-      };
-    }
-    return { passed: false, output };
-  }
-}
-// src/run-sizing.ts
-init_dist();
 
-// src/runner.ts
-init_dist();
-import { getConfigDir } from "@gethmy/mcp/src/config.js";
-var HARMONY_CREDENTIAL_KEYS = [
-  "HARMONY_API_KEY",
-  "HARMONY_API_URL",
-  "HARMONY_WORKSPACE_ID",
-  "SUPABASE_ANON_KEY",
-  "SUPABASE_SERVICE_ROLE_KEY",
-  "SUPABASE_URL"
-];
-function mayHoldCredentials(role) {
-  return role === "author" || role === "reviewer";
-}
-function credentialReadDeny() {
-  return `Read(/${getConfigDir()}/**)`;
-}
-function credentialAccessDeny() {
-  const dir = `/${getConfigDir()}/**`;
-  return [`Read(${dir})`, `Grep(${dir})`, `Glob(${dir})`];
-}
-function buildRoleLaunch(args) {
-  const role = normalizeStageRole(args.role);
-  const keep = mayHoldCredentials(role);
-  const env = {};
-  for (const [key, value] of Object.entries(args.parentEnv)) {
-    if (value === undefined)
-      continue;
-    if (!keep && HARMONY_CREDENTIAL_KEYS.includes(key))
-      continue;
-    env[key] = value;
-  }
-  return {
-    role,
-    prompt: args.prompt,
-    repoPath: args.repoPath,
-    env,
-    disallowedTools: keep ? [] : [credentialReadDeny()]
-  };
-}
-function envKeysDroppedByLaunch(parentEnv, launch) {
-  return Object.keys(parentEnv).filter((key) => parentEnv[key] !== undefined && !Object.hasOwn(launch.env, key));
-}
+// src/index.ts
+init_run_containment();
 
 // src/run-sizing.ts
+init_dist();
+init_confine_to_repo();
+init_runner();
 var SIZING_MODEL = "haiku";
 var SIZING_MAX_TURNS = 25;
 var SIZING_MAX_BUDGET_USD = 0.75;
@@ -4425,6 +4833,10 @@ async function sizeRun(deps) {
       clearTimeout(timer);
   }
 }
+
+// src/index.ts
+init_runner();
+
 // src/stage-run.ts
 async function runStage(request, deps) {
   const events = [];
@@ -4454,6 +4866,7 @@ init_log();
 import { execFileSync as execFileSync8, execSync } from "node:child_process";
 import { existsSync as existsSync3, readdirSync as readdirSync2, rmSync } from "node:fs";
 import { resolve as resolve3 } from "node:path";
+init_run_containment();
 var TAG16 = "worktree";
 
 class WorktreeBaseError extends Error {
@@ -4462,7 +4875,7 @@ class WorktreeBaseError extends Error {
     this.name = "WorktreeBaseError";
   }
 }
-function fetchBaseBranch(repoRoot, baseBranch, attempts = 3, fetchImpl = (root, branch) => execFileSync8("git", ["fetch", "origin", branch], {
+function fetchBaseBranch(repoRoot, baseBranch, attempts = 3, fetchImpl = (root, branch) => execFileSync8("git", [...GIT_NO_HOOKS, "fetch", "origin", branch], {
   cwd: root,
   stdio: "pipe"
 })) {
@@ -4515,7 +4928,14 @@ function resolveContinuationTarget(branchName, continueRequested, failedBranchPr
     reason: "fresh"
   };
 }
-function fetchExistingBranch(repoRoot, branchName, attempts = 3, lsRemoteImpl = (root, branch) => execFileSync8("git", ["ls-remote", "--exit-code", "origin", `refs/heads/${branch}`], { cwd: root, stdio: "pipe" }), fetchImpl = (root, branch) => execFileSync8("git", [
+function fetchExistingBranch(repoRoot, branchName, attempts = 3, lsRemoteImpl = (root, branch) => execFileSync8("git", [
+  ...GIT_NO_HOOKS,
+  "ls-remote",
+  "--exit-code",
+  "origin",
+  `refs/heads/${branch}`
+], { cwd: root, stdio: "pipe" }), fetchImpl = (root, branch) => execFileSync8("git", [
+  ...GIT_NO_HOOKS,
   "fetch",
   "origin",
   `+refs/heads/${branch}:refs/remotes/origin/${branch}`
@@ -4549,7 +4969,7 @@ function fetchExistingBranch(repoRoot, branchName, attempts = 3, lsRemoteImpl =
 }
 function readWorktreeHead(worktreePath) {
   try {
-    return execFileSync8("git", ["rev-parse", "HEAD"], {
+    return execFileSync8("git", [...GIT_NO_HOOKS, "rev-parse", "HEAD"], {
       cwd: worktreePath,
       encoding: "utf-8"
     }).trim();
@@ -4558,7 +4978,7 @@ function readWorktreeHead(worktreePath) {
   }
 }
 function createWorktree(basePath, baseBranch, branchName, opts = {}) {
-  const repoRoot = execFileSync8("git", ["rev-parse", "--show-toplevel"], {
+  const repoRoot = execFileSync8("git", [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8"
   }).trim();
   const worktreeDir = resolve3(repoRoot, basePath, branchName);
@@ -4567,7 +4987,7 @@ function createWorktree(basePath, baseBranch, branchName, opts = {}) {
     cleanupWorktree(worktreeDir, branchName);
   }
   try {
-    execFileSync8("git", ["worktree", "prune", "--expire=now"], {
+    execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"], {
       cwd: repoRoot,
       stdio: "pipe"
     });
@@ -4576,37 +4996,54 @@ function createWorktree(basePath, baseBranch, branchName, opts = {}) {
   const startRef = resolveWorktreeStartRef(baseBranch, branchName, opts.continueExisting ?? false, () => opts.branchExistsOnOrigin ?? fetchExistingBranch(repoRoot, branchName));
   log.info(TAG16, `Creating worktree: ${worktreeDir} (branch: ${branchName}, base: ${startRef})`);
   try {
-    execFileSync8("git", ["worktree", "add", "-B", branchName, worktreeDir, startRef], { cwd: repoRoot, stdio: "pipe" });
+    execFileSync8("git", [
+      ...GIT_NO_HOOKS,
+      "worktree",
+      "add",
+      "-B",
+      branchName,
+      worktreeDir,
+      startRef
+    ], { cwd: repoRoot, stdio: "pipe" });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
     log.warn(TAG16, `worktree add failed, attempting forced recovery: ${msg}`);
     removeWorktreeHoldingBranch(repoRoot, branchName, worktreeDir);
     try {
-      execFileSync8("git", ["worktree", "remove", worktreeDir, "--force"], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "remove", worktreeDir, "--force"], {
         cwd: repoRoot,
         stdio: "pipe"
       });
     } catch {}
     try {
-      execFileSync8("git", ["worktree", "prune", "--expire=now"], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"], {
         cwd: repoRoot,
         stdio: "pipe"
       });
     } catch {}
     try {
-      execFileSync8("git", ["branch", "-D", branchName], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe"
       });
     } catch {}
-    execFileSync8("git", ["worktree", "add", "-B", branchName, worktreeDir, startRef], { cwd: repoRoot, stdio: "pipe" });
+    execFileSync8("git", [
+      ...GIT_NO_HOOKS,
+      "worktree",
+      "add",
+      "-B",
+      branchName,
+      worktreeDir,
+      startRef
+    ], { cwd: repoRoot, stdio: "pipe" });
   }
   log.info(TAG16, "Installing dependencies in worktree...");
   try {
-    execSync(installCommand(), {
+    execSync(installCommand(true), {
       cwd: worktreeDir,
       stdio: "pipe",
-      timeout: 60000
+      timeout: 60000,
+      env: containedEnv()
     });
   } catch {
     log.warn(TAG16, "Install failed (may be fine if deps are hoisted)");
@@ -4625,7 +5062,7 @@ function containsForeignWorktrees(dir) {
   return children.some((child) => existsSync3(resolve3(dir, child, ".git")));
 }
 function cleanupWorktree(worktreePath, branchName) {
-  const repoRoot = execFileSync8("git", ["rev-parse", "--show-toplevel"], {
+  const repoRoot = execFileSync8("git", [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8"
   }).trim();
   if (existsSync3(worktreePath)) {
@@ -4633,7 +5070,7 @@ function cleanupWorktree(worktreePath, branchName) {
       throw new Error(`Refusing to remove ${worktreePath}: it is not a git worktree itself, ` + `but git worktrees live directly beneath it. Removing it would ` + `destroy them — pass the individual worktree paths instead (#928).`);
     }
     try {
-      execFileSync8("git", ["worktree", "remove", worktreePath, "--force"], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "remove", worktreePath, "--force"], {
         cwd: repoRoot,
         stdio: "pipe"
       });
@@ -4644,7 +5081,7 @@ function cleanupWorktree(worktreePath, branchName) {
         rmSync(worktreePath, { recursive: true, force: true });
       }
       try {
-        execFileSync8("git", ["worktree", "prune", "--expire=now"], {
+        execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"], {
           cwd: repoRoot,
           stdio: "pipe"
         });
@@ -4652,7 +5089,7 @@ function cleanupWorktree(worktreePath, branchName) {
     }
   } else {
     try {
-      execFileSync8("git", ["worktree", "prune", "--expire=now"], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"], {
         cwd: repoRoot,
         stdio: "pipe"
       });
@@ -4660,7 +5097,7 @@ function cleanupWorktree(worktreePath, branchName) {
   }
   if (branchName) {
     try {
-      execFileSync8("git", ["branch", "-D", branchName], {
+      execFileSync8("git", [...GIT_NO_HOOKS, "branch", "-D", branchName], {
         cwd: repoRoot,
         stdio: "pipe"
       });
@@ -4670,7 +5107,7 @@ function cleanupWorktree(worktreePath, branchName) {
 function removeWorktreeHoldingBranch(repoRoot, branchName, exceptDir) {
   let listing;
   try {
-    listing = execFileSync8("git", ["worktree", "list", "--porcelain"], {
+    listing = execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "list", "--porcelain"], {
       cwd: repoRoot,
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
@@ -4698,7 +5135,7 @@ function removeWorktreeHoldingBranch(repoRoot, branchName, exceptDir) {
   if (exceptDir && resolve3(holderPath) === resolve3(exceptDir))
     return null;
   try {
-    execFileSync8("git", ["worktree", "remove", holderPath, "--force"], {
+    execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "remove", holderPath, "--force"], {
       cwd: repoRoot,
       stdio: "pipe"
     });
@@ -4708,7 +5145,7 @@ function removeWorktreeHoldingBranch(repoRoot, branchName, exceptDir) {
     return null;
   }
   try {
-    execFileSync8("git", ["worktree", "prune", "--expire=now"], {
+    execFileSync8("git", [...GIT_NO_HOOKS, "worktree", "prune", "--expire=now"], {
       cwd: repoRoot,
       stdio: "pipe"
     });
@@ -4716,13 +5153,19 @@ function removeWorktreeHoldingBranch(repoRoot, branchName, exceptDir) {
   return holderPath;
 }
 function resolveRepoRoot() {
-  return execFileSync8("git", ["rev-parse", "--show-toplevel"], {
+  return execFileSync8("git", [...GIT_NO_HOOKS, "rev-parse", "--show-toplevel"], {
     encoding: "utf-8"
   }).trim();
 }
 function localBranchExists(branchName, repoRoot) {
   try {
-    execFileSync8("git", ["show-ref", "--verify", "--quiet", `refs/heads/${branchName}`], { cwd: repoRoot, stdio: "ignore" });
+    execFileSync8("git", [
+      ...GIT_NO_HOOKS,
+      "show-ref",
+      "--verify",
+      "--quiet",
+      `refs/heads/${branchName}`
+    ], { cwd: repoRoot, stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -4732,7 +5175,7 @@ function branchAheadOfItsRemote(branchName, repoRoot = resolveRepoRoot()) {
   if (!localBranchExists(branchName, repoRoot))
     return false;
   try {
-    const out = execFileSync8("git", ["rev-list", branchName, "--not", "--remotes=origin"], { cwd: repoRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    const out = execFileSync8("git", [...GIT_NO_HOOKS, "rev-list", branchName, "--not", "--remotes=origin"], { cwd: repoRoot, encoding: "utf-8", stdio: ["ignore", "pipe", "pipe"] }).trim();
     return out.length > 0;
   } catch {
     return false;
@@ -4785,11 +5228,14 @@ function makeBranchName(shortId, title, prefix = "agent-attempts/") {
 // src/index.ts
 var MOTOR_NAME = "harmony-harness";
 export {
+  writeOnlyDenyPaths,
   waitForDevServer,
+  verificationSandbox,
   validateGitProviderCli,
   upsertReviewedSha,
   upsertCiReviewRequestedSha,
   updateExistingPr,
+  toolchainCacheDirectories,
   testCommand,
   terminateGroup,
   teardownWorktree,
@@ -4802,6 +5248,7 @@ export {
   sizingEventSource,
   sizeRun,
   signalGroup,
+  secretEnvKeysToStrip,
   sanitizeCiText,
   sandboxRunArgs,
   sandboxAvailable,
@@ -4856,7 +5303,13 @@ export {
   isPrOnOrigin,
   isInsideTree,
   installCommand,
+  implementRunToolPolicy,
+  implementRunContainmentCliArgs,
+  implementRunContainment,
+  hostPersistencePaths,
+  harmonyMcpServer,
   gradeOracleRed,
+  gitMetadataDenyPaths,
   getPrStatus,
   getPrFailedChecks,
   getHeadSha,
@@ -4886,10 +5339,14 @@ export {
   deriveCiStatus,
   decidePrBranch,
   decideConfinedTool,
+  credentialWriteToolDeny,
+  credentialToolDeny,
+  credentialDirectories,
   credentialAccessDeny,
   createWorktree,
   createPullRequest,
   cooldownMsFor,
+  containedEnv,
   confineToRepo,
   collectSizingOutput,
   collectGateEvidence,
@@ -4908,14 +5365,17 @@ export {
   buildCommand,
   branchAheadOfItsRemote,
   attemptAutoFix,
+  assertNoProjectSandboxOverride,
   _resetCache,
   __resetSandboxProbe,
   WorktreeBaseError,
   SdkAgentRunner,
   SIZING_MODEL,
   SDK_ALLOWED_TOOLS,
+  SANDBOX_STARTUP_GRACE_MS,
   SANDBOX_MOUNT,
   ReviewPassedCollector,
+  ProjectSandboxOverrideError,
   OracleRedCollector,
   OracleCollector,
   ORACLE_RUNNER_HINTS,
@@ -4925,8 +5385,10 @@ export {
   MAX_IMPLEMENT_MODEL,
   MAX_CHANGED_FILES,
   JUDGE_MODEL,
+  IMPLEMENT_ALLOWED_DOMAINS,
   HarmonyClient,
   HARMONY_CREDENTIAL_KEYS,
+  GIT_NO_HOOKS,
   GATE_CONFIG_ERROR_MARK,
   GATE_CONFIG_ERROR_KEY,
   DevServerReadinessError,