@google/gemini-cli 0.57.0-preview.1 → 0.58.0-preview.0

package/bundle/{interactiveCli-D6H37PJQ.js → interactiveCli-N6VXS5Z4.js}

@@ -157,10 +157,10 @@ import {
   widestLineFromStyledChars,
   wordBreakStyledChars,
   wrapStyledChars
-} from "./chunk-FHDRG5U4.js";
+} from "./chunk-JO5YRKX4.js";
 import {
   require_source
-} from "./chunk-Y3APL4PE.js";
+} from "./chunk-PXFYRLFH.js";
 import {
   appEvents
 } from "./chunk-5PS3AYFU.js";
@@ -214,24 +214,24 @@ import {
   stripAnsi,
   stripUnsafeCharacters,
   toCodePoints
-} from "./chunk-GK7NUJ35.js";
+} from "./chunk-2DH4DX65.js";
 import {
   handleAutoUpdate,
   isDevelopment,
   relaunchApp,
   setUpdateHandler
-} from "./chunk-MBWROXYM.js";
+} from "./chunk-GNLIR4RW.js";
 import {
   isTodoList,
   mapCoreStatusToDisplayStatus,
   require_react
-} from "./chunk-XESAM7IL.js";
+} from "./chunk-JCGNL7TH.js";
 import {
   registerCleanup,
   removeCleanup,
   runExitCleanup,
   setupTtyCheck
-} from "./chunk-3NPMAHLX.js";
+} from "./chunk-CNAVMEMA.js";
 import {
   ACTIVATE_SKILL_TOOL_NAME,
   AGENT_TOOL_NAME,
@@ -437,7 +437,7 @@ import {
   validatePlanContent,
   validatePlanPath,
   writeToStdout
-} from "./chunk-G65GW52B.js";
+} from "./chunk-TYMOJXZO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
@@ -28541,7 +28541,6 @@ var useGeminiStream = (geminiClient, history, addItem, config, settings, onDebug
               geminiClient.getHistory().slice(0, targetLength)
             );
           }
-          historyLengthAfterUserPromptRef.current = void 0;
         }
         const callIdsToMarkAsSubmitted2 = geminiTools.map(
           (toolCall) => toolCall.request.callId
@@ -33965,7 +33964,7 @@ ${queuedText}` : queuedText;
       if (keyMatchers["app.showErrorDetails" /* SHOW_ERROR_DETAILS */](key)) {
         if (settings.merged.general.devtools) {
           void (async () => {
-            const { toggleDevToolsPanel } = await import("./devtoolsService-JBFUXTCT.js");
+            const { toggleDevToolsPanel } = await import("./devtoolsService-BUAVSMN6.js");
             await toggleDevToolsPanel(
               config,
               showErrorDetails,

package/bundle/{liteRtServerManager-3BY6TBHG.js → liteRtServerManager-L46MRFSW.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-ALVDOQNA.js";
-import "./chunk-VBK54QCZ.js";
+} from "./chunk-FJTXPUG2.js";
+import "./chunk-OEY2TDVE.js";
 import {
   debugLogger
-} from "./chunk-O7SBKM7M.js";
+} from "./chunk-4KFMA4KD.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-EXAQFM4Y.js");
+      const { startServer } = await import("./start-2365H4YX.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/{liteRtServerManager-C5WZRQUF.js → liteRtServerManager-QUODN3RR.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-LNXGFWGZ.js";
-import "./chunk-GMQ6QNZB.js";
+} from "./chunk-2DH4DX65.js";
+import "./chunk-JCGNL7TH.js";
 import {
   debugLogger
-} from "./chunk-WDFSF5L4.js";
+} from "./chunk-TYMOJXZO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-SVNTSNHV.js");
+      const { startServer } = await import("./start-Y7LKFE47.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/{liteRtServerManager-IGKUGGP4.js → liteRtServerManager-YLOGF7RQ.js}

@@ -3,11 +3,11 @@ import {
   DEFAULT_PORT,
   getBinaryPath,
   isServerRunning
-} from "./chunk-GK7NUJ35.js";
-import "./chunk-XESAM7IL.js";
+} from "./chunk-FMLOQLUD.js";
+import "./chunk-7HQEQECM.js";
 import {
   debugLogger
-} from "./chunk-G65GW52B.js";
+} from "./chunk-M33HH4UA.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
@@ -41,7 +41,7 @@ var LiteRtServerManager = class {
       `[LiteRtServerManager] Auto-starting LiteRT server on port ${port}...`
     );
     try {
-      const { startServer } = await import("./start-ZXU5BFZY.js");
+      const { startServer } = await import("./start-VPQOFEIR.js");
       const started = await startServer(binaryPath, port);
       if (started) {
         debugLogger.log(`[LiteRtServerManager] Server started on port ${port}`);

package/bundle/{oauth2-provider-KSRLPOK3.js → oauth2-provider-BKWSLZJ6.js}

@@ -16,7 +16,7 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-O7SBKM7M.js";
+} from "./chunk-M33HH4UA.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";

package/bundle/{oauth2-provider-VHNLCU4Y.js → oauth2-provider-IIC2YPC5.js}

@@ -16,35 +16,35 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-NPOI4K6X.js";
+} from "./chunk-4KFMA4KD.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";
 import "./chunk-34MYV7JD.js";
 
-// packages/core/dist/src/agents/auth-provider/oauth2-provider.js
+// packages/core/src/agents/auth-provider/oauth2-provider.ts
 var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
-  config;
-  agentName;
-  agentCardUrl;
-  type = "oauth2";
-  tokenStorage;
-  cachedToken = null;
-  /** Resolved OAuth URLs — may come from config or agent card. */
-  authorizationUrl;
-  tokenUrl;
-  scopes;
   constructor(config, agentName, agentCard, agentCardUrl) {
     super();
     this.config = config;
     this.agentName = agentName;
     this.agentCardUrl = agentCardUrl;
-    this.tokenStorage = new MCPOAuthTokenStorage(Storage.getA2AOAuthTokensPath(), "gemini-cli-a2a");
+    this.tokenStorage = new MCPOAuthTokenStorage(
+      Storage.getA2AOAuthTokensPath(),
+      "gemini-cli-a2a"
+    );
     this.authorizationUrl = config.authorization_url;
     this.tokenUrl = config.token_url;
     this.scopes = config.scopes;
     this.mergeAgentCardDefaults(agentCard);
   }
+  type = "oauth2";
+  tokenStorage;
+  cachedToken = null;
+  /** Resolved OAuth URLs — may come from config or agent card. */
+  authorizationUrl;
+  tokenUrl;
+  scopes;
   /**
    * Initialize the provider by loading any persisted token from storage.
    * Also discovers OAuth URLs from the agent card if not yet resolved.
@@ -56,7 +56,9 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
     const credentials = await this.tokenStorage.getCredentials(this.agentName);
     if (credentials && !this.tokenStorage.isTokenExpired(credentials.token)) {
       this.cachedToken = credentials.token;
-      debugLogger.debug(`[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`);
+      debugLogger.debug(
+        `[OAuth2AuthProvider] Loaded valid cached token for "${this.agentName}"`
+      );
     }
   }
   /**
@@ -69,16 +71,25 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
     }
     if (this.cachedToken?.refreshToken && this.tokenUrl && this.config.client_id) {
       try {
-        const refreshed = await refreshAccessToken({
-          clientId: this.config.client_id,
-          clientSecret: this.config.client_secret,
-          scopes: this.scopes
-        }, this.cachedToken.refreshToken, this.tokenUrl);
-        this.cachedToken = this.toOAuthToken(refreshed, this.cachedToken.refreshToken);
+        const refreshed = await refreshAccessToken(
+          {
+            clientId: this.config.client_id,
+            clientSecret: this.config.client_secret,
+            scopes: this.scopes
+          },
+          this.cachedToken.refreshToken,
+          this.tokenUrl
+        );
+        this.cachedToken = this.toOAuthToken(
+          refreshed,
+          this.cachedToken.refreshToken
+        );
         await this.persistToken();
         return { Authorization: `Bearer ${this.cachedToken.accessToken}` };
       } catch (error) {
-        debugLogger.debug(`[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`);
+        debugLogger.debug(
+          `[OAuth2AuthProvider] Refresh failed, falling back to interactive flow: ${getErrorMessage(error)}`
+        );
         await this.tokenStorage.deleteCredentials(this.agentName);
       }
     }
@@ -97,7 +108,9 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
       return void 0;
     }
     this.authRetryCount++;
-    debugLogger.debug("[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating");
+    debugLogger.debug(
+      "[OAuth2AuthProvider] Auth failure, clearing token and re-authenticating"
+    );
     this.cachedToken = null;
     await this.tokenStorage.deleteCredentials(this.agentName);
     return this.headers();
@@ -110,8 +123,7 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    * `securitySchemes` when not already provided via user config.
    */
   mergeAgentCardDefaults(agentCard) {
-    if (!agentCard?.securitySchemes)
-      return;
+    if (!agentCard?.securitySchemes) return;
     for (const scheme of Object.values(agentCard.securitySchemes)) {
       if (scheme.type === "oauth2" && scheme.flows.authorizationCode) {
         const flow = scheme.flows.authorizationCode;
@@ -127,15 +139,18 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    * (which normalizes proto-format cards) and extract OAuth2 URLs.
    */
   async fetchAgentCardDefaults() {
-    if (!this.agentCardUrl)
-      return;
+    if (!this.agentCardUrl) return;
     try {
-      debugLogger.debug(`[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`);
+      debugLogger.debug(
+        `[OAuth2AuthProvider] Fetching agent card from ${this.agentCardUrl}`
+      );
       const resolver = new DefaultAgentCardResolver();
       const card = await resolver.resolve(this.agentCardUrl, "");
       this.mergeAgentCardDefaults(card);
     } catch (error) {
-      debugLogger.warn(`[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`);
+      debugLogger.warn(
+        `[OAuth2AuthProvider] Could not fetch agent card for OAuth URL discovery: ${getErrorMessage(error)}`
+      );
     }
   }
   /**
@@ -143,10 +158,14 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
    */
   async authenticateInteractively() {
     if (!this.config.client_id) {
-      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`);
+      throw new Error(
+        `OAuth2 authentication for agent "${this.agentName}" requires a client_id. Add client_id to the auth config in your agent definition.`
+      );
     }
     if (!this.authorizationUrl || !this.tokenUrl) {
-      throw new Error(`OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`);
+      throw new Error(
+        `OAuth2 authentication for agent "${this.agentName}" requires authorization_url and token_url. Provide them in the auth config or ensure the agent card exposes an oauth2 security scheme.`
+      );
     }
     const flowConfig = {
       clientId: this.config.client_id,
@@ -165,25 +184,36 @@ var OAuth2AuthProvider = class extends BaseA2AAuthProvider {
       redirectPort,
       /* resource= */
       void 0
+      // No MCP resource parameter for A2A.
+    );
+    const consent = await getConsentForOauth(
+      `Authentication required for A2A agent: '${this.agentName}'.`
     );
-    const consent = await getConsentForOauth(`Authentication required for A2A agent: '${this.agentName}'.`);
     if (!consent) {
       throw new FatalCancellationError("Authentication cancelled by user.");
     }
-    coreEvents.emitFeedback("info", `\u2192 Opening your browser for OAuth sign-in...
+    coreEvents.emitFeedback(
+      "info",
+      `\u2192 Opening your browser for OAuth sign-in...
 
 If the browser does not open, copy and paste this URL into your browser:
 ${authUrl}
 
 \u{1F4A1} TIP: Triple-click to select the entire URL, then copy and paste it into your browser.
-\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`);
+\u26A0\uFE0F  Make sure to copy the COMPLETE URL - it may wrap across multiple lines.`
+    );
     try {
       await openBrowserSecurely(authUrl);
     } catch (error) {
-      debugLogger.warn("Failed to open browser automatically:", getErrorMessage(error));
+      debugLogger.warn(
+        "Failed to open browser automatically:",
+        getErrorMessage(error)
+      );
     }
     const { code } = await callbackServer.response;
-    debugLogger.debug("\u2713 Authorization code received, exchanging for tokens...");
+    debugLogger.debug(
+      "\u2713 Authorization code received, exchanging for tokens..."
+    );
     const tokenResponse = await exchangeCodeForToken(
       flowConfig,
       code,
@@ -220,9 +250,13 @@ ${authUrl}
    * Persist the current cached token to disk.
    */
   async persistToken() {
-    if (!this.cachedToken)
-      return;
-    await this.tokenStorage.saveToken(this.agentName, this.cachedToken, this.config.client_id, this.tokenUrl);
+    if (!this.cachedToken) return;
+    await this.tokenStorage.saveToken(
+      this.agentName,
+      this.cachedToken,
+      this.config.client_id,
+      this.tokenUrl
+    );
   }
 };
 export {

package/bundle/{oauth2-provider-RWKTMYJF.js → oauth2-provider-KVIL4ITH.js}

@@ -16,7 +16,7 @@ import {
   openBrowserSecurely,
   refreshAccessToken,
   startCallbackServer
-} from "./chunk-WDFSF5L4.js";
+} from "./chunk-TYMOJXZO.js";
 import "./chunk-664ZODQF.js";
 import "./chunk-IUUIT4SU.js";
 import "./chunk-TUDYL3X4.js";

package/bundle/policies/write.toml

@@ -39,7 +39,11 @@ decision = "allow"
 priority = 15
 modes = ["autoEdit"]
 
-[rule.safety_checker]
+[[safety_checker]]
+toolName = "replace"
+priority = 15
+modes = ["autoEdit"]
+[safety_checker.checker]
 type = "in-process"
 name = "allowed-path"
 required_context = ["environment"]
@@ -68,7 +72,11 @@ decision = "allow"
 priority = 15
 modes = ["autoEdit"]
 
-[rule.safety_checker]
+[[safety_checker]]
+toolName = "write_file"
+priority = 15
+modes = ["autoEdit"]
+[safety_checker.checker]
 type = "in-process"
 name = "allowed-path"
 required_context = ["environment"]

package/bundle/sandbox-macos-permissive-open.sb

@@ -133,3 +133,53 @@
 
 ;; allow all outbound network traffic
 (allow network-outbound)
+
+;; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+    (literal "/var/run/docker.sock")
+    (literal "/var/run/docker.sock.raw")
+    (literal "/private/var/run/docker.sock")
+    (literal "/private/var/run/docker.sock.raw")
+    (subpath "/var/run/docker")
+    (subpath "/private/var/run/docker")
+    (subpath "/Users/Shared/.docker")
+    (subpath (string-append (param "HOME_DIR") "/.docker/run"))
+    (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
+    (subpath (string-append (param "HOME_DIR") "/.colima"))
+    (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
+    (subpath (string-append (param "HOME_DIR") "/.rd"))
+)
+
+;; Block container CLI and daemon binaries from execution
+(deny process-exec
+    (literal "/usr/local/bin/docker")
+    (literal "/usr/local/bin/dockerd")
+    (literal "/usr/local/bin/docker-compose")
+    (literal "/usr/bin/docker")
+    (literal "/opt/homebrew/bin/docker")
+    (literal "/opt/homebrew/bin/dockerd")
+    (literal "/opt/homebrew/bin/docker-compose")
+    (literal "/opt/homebrew/bin/podman")
+    (literal "/usr/local/bin/podman")
+    (literal "/opt/homebrew/bin/colima")
+    (literal "/usr/local/bin/colima")
+    (literal "/opt/homebrew/bin/orb")
+    (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+    (subpath "/Applications/Docker.app/Contents/MacOS/")
+    (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+    (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+;; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+    (xpc-service-name-prefix "com.docker.")
+    (global-name-prefix "com.docker.")
+    (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+;; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+    (ipc-posix-name-prefix "docker")
+    (ipc-posix-name-prefix "com.docker.")
+)
+

package/bundle/sandbox-macos-permissive-proxied.sb

@@ -136,3 +136,53 @@
 ;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
 ;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
 (allow network-outbound (remote tcp "localhost:8877"))
+
+;; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+    (literal "/var/run/docker.sock")
+    (literal "/var/run/docker.sock.raw")
+    (literal "/private/var/run/docker.sock")
+    (literal "/private/var/run/docker.sock.raw")
+    (subpath "/var/run/docker")
+    (subpath "/private/var/run/docker")
+    (subpath "/Users/Shared/.docker")
+    (subpath (string-append (param "HOME_DIR") "/.docker/run"))
+    (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
+    (subpath (string-append (param "HOME_DIR") "/.colima"))
+    (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
+    (subpath (string-append (param "HOME_DIR") "/.rd"))
+)
+
+;; Block container CLI and daemon binaries from execution
+(deny process-exec
+    (literal "/usr/local/bin/docker")
+    (literal "/usr/local/bin/dockerd")
+    (literal "/usr/local/bin/docker-compose")
+    (literal "/usr/bin/docker")
+    (literal "/opt/homebrew/bin/docker")
+    (literal "/opt/homebrew/bin/dockerd")
+    (literal "/opt/homebrew/bin/docker-compose")
+    (literal "/opt/homebrew/bin/podman")
+    (literal "/usr/local/bin/podman")
+    (literal "/opt/homebrew/bin/colima")
+    (literal "/usr/local/bin/colima")
+    (literal "/opt/homebrew/bin/orb")
+    (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+    (subpath "/Applications/Docker.app/Contents/MacOS/")
+    (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+    (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+;; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+    (xpc-service-name-prefix "com.docker.")
+    (global-name-prefix "com.docker.")
+    (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+;; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+    (ipc-posix-name-prefix "docker")
+    (ipc-posix-name-prefix "com.docker.")
+)
+

package/bundle/sandbox-macos-restrictive-open.sb

@@ -92,4 +92,53 @@
 (allow network-inbound (local ip "localhost:9229"))
 
 ;; allow all outbound network traffic
-(allow network-outbound)
+(allow network-outbound)
+
+;; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+    (literal "/var/run/docker.sock")
+    (literal "/var/run/docker.sock.raw")
+    (literal "/private/var/run/docker.sock")
+    (literal "/private/var/run/docker.sock.raw")
+    (subpath "/var/run/docker")
+    (subpath "/private/var/run/docker")
+    (subpath "/Users/Shared/.docker")
+    (subpath (string-append (param "HOME_DIR") "/.docker/run"))
+    (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
+    (subpath (string-append (param "HOME_DIR") "/.colima"))
+    (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
+    (subpath (string-append (param "HOME_DIR") "/.rd"))
+)
+
+;; Block container CLI and daemon binaries from execution
+(deny process-exec
+    (literal "/usr/local/bin/docker")
+    (literal "/usr/local/bin/dockerd")
+    (literal "/usr/local/bin/docker-compose")
+    (literal "/usr/bin/docker")
+    (literal "/opt/homebrew/bin/docker")
+    (literal "/opt/homebrew/bin/dockerd")
+    (literal "/opt/homebrew/bin/docker-compose")
+    (literal "/opt/homebrew/bin/podman")
+    (literal "/usr/local/bin/podman")
+    (literal "/opt/homebrew/bin/colima")
+    (literal "/usr/local/bin/colima")
+    (literal "/opt/homebrew/bin/orb")
+    (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+    (subpath "/Applications/Docker.app/Contents/MacOS/")
+    (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+    (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+;; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+    (xpc-service-name-prefix "com.docker.")
+    (global-name-prefix "com.docker.")
+    (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+;; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+    (ipc-posix-name-prefix "docker")
+    (ipc-posix-name-prefix "com.docker.")
+)

package/bundle/sandbox-macos-restrictive-proxied.sb

@@ -95,3 +95,53 @@
 ;; set `GEMINI_SANDBOX_PROXY_COMMAND=<command>` to run proxy alongside sandbox
 ;; proxy must listen on :::8877 (see docs/examples/proxy-script.md)
 (allow network-outbound (remote tcp "localhost:8877"))
+
+;; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+    (literal "/var/run/docker.sock")
+    (literal "/var/run/docker.sock.raw")
+    (literal "/private/var/run/docker.sock")
+    (literal "/private/var/run/docker.sock.raw")
+    (subpath "/var/run/docker")
+    (subpath "/private/var/run/docker")
+    (subpath "/Users/Shared/.docker")
+    (subpath (string-append (param "HOME_DIR") "/.docker/run"))
+    (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
+    (subpath (string-append (param "HOME_DIR") "/.colima"))
+    (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
+    (subpath (string-append (param "HOME_DIR") "/.rd"))
+)
+
+;; Block container CLI and daemon binaries from execution
+(deny process-exec
+    (literal "/usr/local/bin/docker")
+    (literal "/usr/local/bin/dockerd")
+    (literal "/usr/local/bin/docker-compose")
+    (literal "/usr/bin/docker")
+    (literal "/opt/homebrew/bin/docker")
+    (literal "/opt/homebrew/bin/dockerd")
+    (literal "/opt/homebrew/bin/docker-compose")
+    (literal "/opt/homebrew/bin/podman")
+    (literal "/usr/local/bin/podman")
+    (literal "/opt/homebrew/bin/colima")
+    (literal "/usr/local/bin/colima")
+    (literal "/opt/homebrew/bin/orb")
+    (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+    (subpath "/Applications/Docker.app/Contents/MacOS/")
+    (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+    (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+;; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+    (xpc-service-name-prefix "com.docker.")
+    (global-name-prefix "com.docker.")
+    (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+;; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+    (ipc-posix-name-prefix "docker")
+    (ipc-posix-name-prefix "com.docker.")
+)
+

package/bundle/sandbox-macos-strict-open.sb

@@ -128,3 +128,53 @@
 
 ;; allow all outbound network traffic
 (allow network-outbound)
+
+;; Block Docker & container daemon UNIX domain sockets (read & write)
+(deny file-read* file-write*
+    (literal "/var/run/docker.sock")
+    (literal "/var/run/docker.sock.raw")
+    (literal "/private/var/run/docker.sock")
+    (literal "/private/var/run/docker.sock.raw")
+    (subpath "/var/run/docker")
+    (subpath "/private/var/run/docker")
+    (subpath "/Users/Shared/.docker")
+    (subpath (string-append (param "HOME_DIR") "/.docker/run"))
+    (subpath (string-append (param "HOME_DIR") "/.docker/desktop"))
+    (subpath (string-append (param "HOME_DIR") "/.colima"))
+    (subpath (string-append (param "HOME_DIR") "/.orbstack/run"))
+    (subpath (string-append (param "HOME_DIR") "/.rd"))
+)
+
+;; Block container CLI and daemon binaries from execution
+(deny process-exec
+    (literal "/usr/local/bin/docker")
+    (literal "/usr/local/bin/dockerd")
+    (literal "/usr/local/bin/docker-compose")
+    (literal "/usr/bin/docker")
+    (literal "/opt/homebrew/bin/docker")
+    (literal "/opt/homebrew/bin/dockerd")
+    (literal "/opt/homebrew/bin/docker-compose")
+    (literal "/opt/homebrew/bin/podman")
+    (literal "/usr/local/bin/podman")
+    (literal "/opt/homebrew/bin/colima")
+    (literal "/usr/local/bin/colima")
+    (literal "/opt/homebrew/bin/orb")
+    (literal "/Applications/Docker.app/Contents/Resources/bin/docker")
+    (subpath "/Applications/Docker.app/Contents/MacOS/")
+    (subpath "/Applications/OrbStack.app/Contents/MacOS/")
+    (subpath "/Applications/Rancher Desktop.app/Contents/MacOS/")
+)
+
+;; Block com.docker.* and container manager Mach lookup / XPC services
+(deny mach-lookup
+    (xpc-service-name-prefix "com.docker.")
+    (global-name-prefix "com.docker.")
+    (global-name-prefix "dev.kdrag0n.OrbStack")
+)
+
+;; Block Docker POSIX Shared Memory
+(deny ipc-posix-shm*
+    (ipc-posix-name-prefix "docker")
+    (ipc-posix-name-prefix "com.docker.")
+)
+