@impeccable/reviews 0.1.6 → 0.1.7

package/dist/sandbox.js

@@ -1,9 +1,9 @@
 import { execFileSync, spawn } from 'node:child_process';
 import { randomBytes } from 'node:crypto';
-import { existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync, writeFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
 import { homedir, tmpdir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
 import { createLocalBashOperations } from '@earendil-works/pi-coding-agent';
 import { UserError } from './log.js';
@@ -26,53 +26,302 @@ export function ownFolder() {
     }
     return own;
 }
+/** npm's cache for what runs from there: a host CLI's install and npx for cf fetch through it, and never through ~/.npm, whose entries a sandboxed install could have planted for them. */
+export const ownNpmCache = () => join(ownFolder(), 'npm-cache');
 /**
  * The environment of every git that runs outside the sandbox, the command's own and the person's commands (gh and the
- * host CLIs run git too): no hooks and no fsmonitor, whose programs a sandboxed command could have written, and, once
+ * host CLIs run git too): no hooks and no fsmonitor, whose programs a sandboxed command could have written, no replacement
+ * objects, whose refs it could have written to show a commit other than the one a push sends, and, once
  * the sandbox started, this checkout's git folders named rather than found, so a .git or a commondir a sandboxed
- * command made is never what git reads.
+ * command made is never what git reads. Nor GH_REPO and GH_HOST, which would aim gh at another repository or host than
+ * this checkout's, as the person.
  */
-export function gitEnvironment(env = process.env) {
+export function gitEnvironment({ GH_REPO, GH_HOST, ...env } = process.env) {
     const settings = [env.GIT_CONFIG_PARAMETERS, "'core.hooksPath=/dev/null' 'core.fsmonitor=false'"].filter(Boolean).join(' ');
-    return { ...env, GIT_CONFIG_PARAMETERS: settings, ...(pinned ? { GIT_DIR: pinned.gitDir, GIT_COMMON_DIR: pinned.commonDir, GIT_WORK_TREE: pinned.root } : {}) };
+    return { ...env, GIT_CONFIG_PARAMETERS: settings, GIT_NO_REPLACE_OBJECTS: '1', ...(pinned ? { GIT_DIR: pinned.gitDir, GIT_COMMON_DIR: pinned.commonDir, GIT_WORK_TREE: pinned.root } : {}) };
 }
-/** Credential folders and files, from the home folder, that no command in the sandbox reads: SSH's, GPG's and the cloud CLIs' keys, and git's, gh's and Docker's sign-ins. */
-const CREDENTIALS = ['.ssh', '.gnupg', '.aws', '.azure', '.config/gcloud', '.kube', '.docker', '.netrc', '.git-credentials', '.config/gh'];
-/** The package managers' caches and stores, which an install writes. */
-const CACHES = ['.npm', '.pnpm-store', '.local/share/pnpm', '.cache/pnpm', '.cache/yarn', '.yarn/berry', '.bun/install/cache', '.cache/node/corepack', '.cache/prisma'];
-/** macOS keeps the keychains, and some of those caches, under Library. */
-const MACOS = { credentials: ['Library/Keychains'], caches: ['Library/pnpm', 'Library/Caches/pnpm', 'Library/Caches/Yarn'] };
 /**
- * What a command in the sandbox reads and writes: it reads what the person can but the credential folders, and writes
+ * The shells' rc files, which often export tokens, and which no shell the sandbox runs reads: the agent's is bash -c, with
+ * no BASH_ENV, and zsh -c skips a denied .zshenv as it skips an absent one.
+ */
+const SHELL_RC = ['.bashrc', '.bash_profile', '.bash_login', '.bash_logout', '.profile', '.zshenv', '.zprofile', '.zshrc', '.zlogin', '.zlogout'];
+/**
+ * Credential folders and files, from the home folder, that no command in the sandbox reads: SSH's, GPG's and the cloud CLIs' keys;
+ * git's, gh's and Docker's sign-ins; git's global settings, whose headers and url rewrites carry tokens (git in the sandbox gets a
+ * scrubbed copy); Vercel's, Netlify's and Cloudflare's CLIs' sign-ins; the registries' publishing tokens; the coding agents'
+ * sign-ins; the shells' rc files and histories; and the browsers' profiles. ~/.npmrc stays readable: the sandbox's hosts come
+ * from its registries, and npm needs its token for them.
+ */
+const CREDENTIALS = [
+    '.ssh', '.gnupg', '.aws', '.azure', '.config/gcloud', '.kube', '.docker', '.netrc', '.git-credentials', '.config/gh',
+    '.gitconfig', '.config/git/config', '.config/git/credentials',
+    '.local/share/com.vercel.cli', '.vercel', '.config/netlify', '.netlify', '.config/.wrangler', '.wrangler',
+    '.yarnrc.yml', '.pypirc', '.cargo/credentials', '.cargo/credentials.toml', '.gem/credentials', '.m2/settings.xml', '.gradle/gradle.properties', '.terraform.d',
+    '.codex', '.claude',
+    ...SHELL_RC, '.config/fish', '.bash_history', '.zsh_history', '.zsh_sessions', '.local/share/fish/fish_history',
+    '.config/google-chrome', '.config/chromium', '.config/BraveSoftware', '.config/microsoft-edge', '.mozilla',
+];
+/**
+ * The variables that move a credential store or a shell's files, and what the sandbox denies under the folder each names: the
+ * store itself (KUBECONFIG names a list of files); cargo's credentials; zsh's rc files under ZDOTDIR; and under XDG_CONFIG_HOME
+ * and XDG_DATA_HOME what is denied under ~/.config and ~/.local/share. The variables themselves stay in the sandbox's
+ * environment: gh and the host CLIs read them outside the sandbox, and the package managers inside it.
+ */
+const under = (prefix) => CREDENTIALS.filter((path) => path.startsWith(prefix)).map((path) => path.slice(prefix.length));
+const MOVED = {
+    GH_CONFIG_DIR: [''], VERCEL_AUTH_CONFIG_DIR: [''], GNUPGHOME: [''], DOCKER_CONFIG: [''], CLOUDSDK_CONFIG: [''], AZURE_CONFIG_DIR: [''], KUBECONFIG: [''],
+    CODEX_HOME: [''], CLAUDE_CONFIG_DIR: [''], GIT_CONFIG_GLOBAL: [''], HISTFILE: [''],
+    CARGO_HOME: ['credentials', 'credentials.toml'], ZDOTDIR: SHELL_RC.filter((name) => name.startsWith('.z')),
+    XDG_CONFIG_HOME: under('.config/'), XDG_DATA_HOME: under('.local/share/'),
+};
+/**
+ * The package managers' caches and stores, which an install writes: pnpm's store alone under PNPM_HOME, whose global
+ * bins are on PATH, and neither npm's cache nor corepack's, which the sandbox's commands keep in the scratch folder, since
+ * the host CLIs' installs and npx run outside it as the person. Nor pnpm's metadata cache, whose dlx folder the person's
+ * next `pnpm dlx` runs from: pnpm reads it when it can and goes on when it cannot write it (pnpm 11).
+ */
+const CACHES = ['.pnpm-store', '.local/share/pnpm/store', '.cache/yarn', '.yarn/berry', '.bun/install/cache', '.cache/prisma'];
+/** macOS keeps the keychains, the host CLIs' sign-ins, the browsers' profiles and cookies, and some of those caches, under Library. */
+const MACOS = {
+    credentials: [
+        'Library/Keychains', 'Library/Application Support/com.vercel.cli', 'Library/Preferences/netlify', 'Library/Preferences/.wrangler',
+        'Library/Application Support/Google/Chrome', 'Library/Application Support/Chromium', 'Library/Application Support/BraveSoftware', 'Library/Application Support/Microsoft Edge', 'Library/Application Support/Firefox', 'Library/Cookies',
+    ],
+    caches: ['Library/pnpm/store', 'Library/Caches/Yarn'],
+};
+/**
+ * Where git takes settings or programs from, in this checkout's git folders: its config, hooks, info and submodules'
+ * folders, a commondir, the other worktrees' git folders, and the .git file of a worktree, which names its folder. No
+ * command in the sandbox writes them, and the run checks them at its end.
+ */
+function gitSettings({ root, gitDir, commonDir }, worktrees) {
+    return [...new Set([
+            ...['config', 'config.worktree', 'hooks', 'info', 'modules'].map((name) => join(commonDir, name)),
+            ...['commondir', 'config.worktree'].map((name) => join(gitDir, name)),
+            ...worktrees.map((name) => join(commonDir, 'worktrees', name)).filter((folder) => folder !== gitDir),
+            ...(gitDir === join(root, '.git') ? [] : [join(root, '.git')]),
+        ])];
+}
+/** The names bubblewrap may put an empty file in place of, when absent, which git reads as nothing; a commondir it dies on. */
+const EMPTY_TO_GIT = new Set(['config.worktree', 'hooks', 'info', 'modules']);
+/**
+ * What the environment's location variables put out of the sandbox's reach, by absolute path, and the files git's global
+ * settings came from: never a folder the checkout, the scratch folder or the home folder is in, which a variable set to
+ * the home folder itself would name, and which every command reads.
+ */
+function moved(env, gitConfigs, kept) {
+    const holds = (path) => kept.some((folder) => {
+        const below = relative(path, folder);
+        return below === '' || (!below.startsWith('..') && !isAbsolute(below));
+    });
+    const named = Object.entries(MOVED).flatMap(([name, below]) => {
+        const value = env[name] ?? '';
+        return (name === 'KUBECONFIG' ? value.split(':') : [value]).filter(isAbsolute).flatMap((folder) => below.map((path) => resolve(folder, path)));
+    });
+    return [...named, ...gitConfigs].filter((path) => !holds(path));
+}
+/**
+ * What a command in the sandbox reads and writes: it reads what the person can but the credential folders, where their
+ * environment moved them, and the files git's global settings come from (`gitConfigs`), and writes
  * in the checkout, its git folders (a worktree's are outside it), the run's scratch folder and the package caches, but
- * never where git reads settings or programs from: config, hooks, info, a commondir, the submodules' and the other
- * worktrees' git folders, and a .git below the checkout's top. Bubblewrap takes no pattern in a write rule, and puts a
- * file in place of a denied path that is not there, which git would read as an empty commondir: on Linux only what is
- * there is denied, and the git that runs outside is pinned to this checkout's folders instead.
+ * never where git reads settings or programs from, nor a .git below the checkout's top. Bubblewrap takes no pattern in
+ * a write rule, and puts a file in place of a denied path that is not there: on Linux the names git reads as nothing
+ * when empty are denied whether there or not, a commondir only when it is there, and a .git below the top not at all;
+ * the git that runs outside is pinned to this checkout's folders instead, and the run's end removes what appeared.
  */
 export function sandboxPolicy(o) {
     const macos = o.platform === 'darwin';
     const { root, gitDir, commonDir } = o.git;
     const inHome = (paths) => paths.map((path) => join(o.home, path));
     const denyWrite = [
-        ...['config', 'config.worktree', 'hooks', 'info', 'modules'].map((name) => join(commonDir, name)),
-        ...['commondir', 'config.worktree'].map((name) => join(gitDir, name)),
-        ...o.worktrees.flatMap((name) => ['commondir', 'config.worktree'].map((file) => join(commonDir, 'worktrees', name, file))),
-        // A worktree's or a submodule's .git is a file that names its git folder.
-        ...(gitDir === join(root, '.git') ? [] : [join(root, '.git')]),
+        ...gitSettings(o.git, o.worktrees),
         ...(macos ? [join(root, '*', '**', '.git')] : []),
-        // Inside npm's cache, which installs write: what npx installed, which the command's own tools run outside the sandbox.
-        join(o.home, '.npm', '_npx'),
     ];
     const exists = o.exists ?? existsSync;
     return {
-        denyRead: inHome([...CREDENTIALS, ...(macos ? MACOS.credentials : [])]),
+        denyRead: [...new Set([...inHome([...CREDENTIALS, ...(macos ? MACOS.credentials : [])]), ...moved(o.env ?? process.env, o.gitConfigs ?? [], [root, o.scratch, o.home])])],
         allowWrite: [...new Set([root, gitDir, commonDir, o.scratch, ...inHome([...CACHES, ...(macos ? MACOS.caches : [])])])],
-        denyWrite: [...new Set(macos ? denyWrite : denyWrite.filter((path) => exists(path)))],
+        denyWrite: [...new Set(macos ? denyWrite : denyWrite.filter((path) => exists(path) || EMPTY_TO_GIT.has(basename(path))))],
+    };
+}
+/**
+ * The global git settings a command in the sandbox keeps: the person's name and email, what shapes how git reads the
+ * checkout (line endings, case, excludes, attributes, and the content filters, which git add runs: of their commands only
+ * LFS's, see LFS_COMMAND, and every filter's `required`) and safe.directory. Nothing that carries or names a sign-in (http's
+ * headers, proxy, cookies and certificates, url rewrites, credential helpers, sendemail's and imap's passwords, includes),
+ * and no alias or program, which a key not listed could name.
+ */
+const KEPT_SETTINGS = /^(?:user\.(?:name|email)|init\.defaultbranch|core\.(?:autocrlf|eol|safecrlf|ignorecase|filemode|symlinks|quotepath|precomposeunicode|excludesfile|attributesfile|longpaths|untrackedcache)|safe\.directory|filter\..+\.(?:clean|smudge|process|required))$/i;
+/**
+ * The filter commands kept, LFS's as `git lfs install` writes them, whole: any other filter command is a program whose
+ * arguments could carry a password. A filter whose command is dropped keeps `required`, so git refuses a file it would have
+ * filtered rather than stage it unfiltered.
+ */
+const LFS_COMMAND = /^git(?:-| +)lfs +(?:clean|smudge|filter-process)(?: +--skip)?(?: +(?:-- +)?%f)?$/;
+/** git's `-z --show-origin` listing, setting by setting: the file it came from, its key, and its value when it has one. */
+function* settings(listing) {
+    const parts = listing.split('\0');
+    for (let i = 0; i + 1 < parts.length; i += 2) {
+        const origin = parts[i], entry = parts[i + 1];
+        const at = entry.indexOf('\n');
+        yield { file: origin.startsWith('file:') ? origin.slice('file:'.length) : undefined, key: at < 0 ? entry : entry.slice(0, at), value: at < 0 ? undefined : entry.slice(at + 1) };
+    }
+}
+/**
+ * The person's global git settings scrubbed for the sandbox, from git's own `-z --show-origin` listing of them (`file:path`,
+ * NUL, the key, a newline and the value, NUL, per setting; the includes that hold for this checkout already read in): the
+ * text of a config file that holds the kept settings, and the files they came from, for the deny list.
+ */
+export function scrubGitConfig(listing) {
+    const quoted = (text) => `"${text.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n').replace(/\t/g, '\\t')}"`;
+    const files = new Set();
+    const sections = new Map();
+    for (const { file, key, value } of settings(listing)) {
+        if (file)
+            files.add(file);
+        if (!KEPT_SETTINGS.test(key) || (/^filter\..+\.(?:clean|smudge|process)$/i.test(key) && !LFS_COMMAND.test(value ?? '')))
+            continue;
+        const section = key.slice(0, key.indexOf('.')), name = key.slice(key.lastIndexOf('.') + 1);
+        const subsection = key.slice(section.length + 1, key.length - name.length - 1);
+        const header = subsection ? `[${section} ${quoted(subsection)}]` : `[${section}]`;
+        const lines = sections.get(header) ?? [];
+        lines.push(value === undefined ? `\t${name}` : `\t${name} = ${quoted(value)}`);
+        sections.set(header, lines);
+    }
+    return { text: [...sections].map(([header, lines]) => `${[header, ...lines].join('\n')}\n`).join(''), files: [...files] };
+}
+/** A setting that names a file git includes: include.path, and includeIf.<condition>.path, whose condition may not hold for this checkout. */
+const INCLUDE = /^include(?:if\..*)?\.path$/i;
+/**
+ * Every file the settings in a listing include, whether the include holds for this checkout or not, since a token sits as
+ * readily behind an includeIf for another one: `~/` from the home folder, a relative path from the including file's folder,
+ * an absolute path as it is, and never another user's `~user/`, which only git resolves.
+ */
+export function gitIncludes(listing, home) {
+    const named = new Set();
+    for (const { file, key, value } of settings(listing)) {
+        if (!INCLUDE.test(key) || value === undefined)
+            continue;
+        if (value.startsWith('~/'))
+            named.add(join(home, value.slice(2)));
+        else if (isAbsolute(value))
+            named.add(value);
+        else if (file && !value.startsWith('~'))
+            named.add(resolve(file, '..', value));
+    }
+    return [...named];
+}
+/**
+ * The scrubbed copy of the person's global git settings, read as the person from the checkout (an includeIf for it holds)
+ * and written where no sandboxed command writes, and the files the settings came from or include, held or not, each read
+ * for what it includes in turn. Without a global config git says so and exits 128, and the copy is empty: git in the
+ * sandbox then reads the checkout's own settings only. A global config or an include that holds for this checkout that git
+ * cannot read otherwise (a bad line, a file it may not open) stops the run, with git's words: what it includes in turn
+ * would stay readable, unknown to the deny list. One held for another checkout only is named in the debug log and stays
+ * denied, and the run goes on, though what it includes in turn stays unknown.
+ */
+function scrubbedGitConfig(root, home, log) {
+    const env = gitEnvironment({ ...process.env, HOME: home });
+    const list = (args, unread) => {
+        try {
+            return execFileSync('git', ['config', ...args, '-z', '--list', '--show-origin'], { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], maxBuffer: 16 * 1024 * 1024, env });
+        }
+        catch (err) {
+            const said = String(err.stderr ?? err.message).trim().split('\n').pop() ?? '';
+            if (/unable to read config file .*: No such file or directory/.test(said))
+                return '';
+            if (unread) {
+                unread(said);
+                return '';
+            }
+            throw new UserError(`Impeccable keeps your global git settings and the files they include out of the sandbox, and git could not read them (${said}). Fix that file, or the setting that includes it, and run impeccable-reviews again.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
+        }
+    };
+    const listing = list(['--global', '--includes']);
+    const { text, files } = scrubGitConfig(listing);
+    const seen = new Set(files);
+    const includes = gitIncludes(listing, home);
+    for (const file of includes) {
+        if (seen.has(file))
+            continue;
+        seen.add(file);
+        // The listing above read every include that holds for this checkout and stopped on one git cannot read, so one that
+        // fails here holds for another checkout only.
+        includes.push(...gitIncludes(list(['--file', file, '--no-includes'], (said) => log.write('git include not read', { file, said })), home));
+    }
+    const path = join(ownFolder(), `gitconfig-${randomBytes(6).toString('hex')}`);
+    writeFileSync(path, text, { mode: 0o600 });
+    return { path, files: [...seen] };
+}
+/** Whether `path` is there, a dangling symlink too. */
+function present(path) {
+    try {
+        lstatSync(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The .git entries below the checkout's top, files and folders, by absolute path; node_modules is not searched, and no symlink is followed. */
+function nestedGits(root) {
+    const found = [];
+    const walk = (folder, top) => {
+        let entries;
+        try {
+            entries = readdirSync(folder, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            const path = join(folder, entry.name);
+            if (entry.name === '.git') {
+                if (!top)
+                    found.push(path);
+            }
+            else if (entry.isDirectory() && entry.name !== 'node_modules')
+                walk(path, false);
+        }
     };
+    walk(root, true);
+    return found;
 }
-/** GitHub and the hosts it serves files from, for a dependency on GitHub. */
-const GITHUB = ['github.com', '*.github.com', '*.githubusercontent.com'];
+/**
+ * The git folders watched over the run, from before any command runs: `settle` removes what appeared since where git
+ * takes settings or programs from (a commondir, a config.worktree, hooks, a .git below the checkout's top), which on
+ * Linux the sandbox cannot deny when absent, and which nothing denies without a sandbox, and names each removal for the
+ * summary. The person's own git would read them after the run, with all their access.
+ */
+export function watchGit(git, worktrees) {
+    const settings = gitSettings(git, worktrees);
+    const before = new Set([...settings.filter(present), ...nestedGits(git.root)]);
+    return {
+        settle() {
+            const appeared = [...settings, ...nestedGits(git.root)].filter((path) => !before.has(path) && present(path));
+            return appeared.map((path) => {
+                const made = `A command made ${relative(git.root, path)} during the run, which git would take settings or programs from`;
+                try {
+                    rmSync(path, { recursive: true, force: true });
+                    return `${made}, so it was removed.`;
+                }
+                catch (err) {
+                    return `${made}, and it could not be removed (${err.code ?? 'unknown error'}): remove it yourself before running git there.`;
+                }
+            });
+        },
+    };
+}
+/**
+ * GitHub's hosts an install of a dependency on GitHub fetches from: git and archives from github.com, tarballs from codeload,
+ * release assets and raw files from githubusercontent, and bun's tarballs from the API. Gists' and uploads' hosts are not among them.
+ */
+const GITHUB = ['github.com', 'api.github.com', 'codeload.github.com', '*.githubusercontent.com'];
+/**
+ * What no command in the sandbox reaches on an allowed host: GitHub over SSH, which git would take through the sandbox's
+ * SOCKS proxy to push with a key a script carries. The reason reaches the client in SSH's own disconnect, so git prints it.
+ */
+const DENIED = { deniedDomains: ['github.com:22'], deniedDomainReasons: { 'github.com:22': 'SSH to GitHub is refused in the sandbox; what pushes runs outside it, as the person.' } };
 /** The public registries a kind of manifest or lockfile installs from. */
 const REGISTRIES = [
     [/(?:^|\/)(?:package\.json|package-lock\.json|npm-shrinkwrap\.json|pnpm-lock\.yaml|bun\.lockb?)$/, ['registry.npmjs.org']],
@@ -136,8 +385,30 @@ export function allowedDomains(s) {
  * the sandbox keeps.
  */
 const INSIDE = { NODE_USE_ENV_PROXY: '1', CYPRESS_INSTALL_BINARY: '0', PUPPETEER_SKIP_DOWNLOAD: '1', PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: '1', HUSKY: '0' };
+/** And, for the agent's shell, npm's cache and corepack's package managers in the run's scratch folder: what a sandboxed install fetched stays with the run, and ~/.npm, which the person's npm and npx read from, is never written. */
+const scratchCaches = (scratch) => ({ npm_config_cache: join(scratch, 'npm-cache'), COREPACK_HOME: join(scratch, 'corepack'), COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' });
+/**
+ * And pnpm's store, the person's, named: pnpm 11 finds it by writing in pnpm's home, which the sandbox refuses, and
+ * otherwise makes a store of its own in the checkout. What an install puts in node_modules is copied from it, never
+ * hard-linked, so a write through an installed file changes neither the store nor a global command linked from it.
+ */
+export const pnpmEnvironment = (home, platform) => ({ pnpm_config_store_dir: join(home, platform === 'darwin' ? 'Library/pnpm/store' : '.local/share/pnpm/store'), pnpm_config_package_import_method: 'copy' });
+/** For a host CLI's install outside the sandbox: npm's cache of the command's own, and the registry asked afresh for what it has. */
+const installEnvironment = () => ({ npm_config_cache: ownNpmCache(), npm_config_prefer_online: 'true' });
 /** The sandbox's own command line, which the local preview check runs each command through, in a sandbox of its own. */
 const SRT = createRequire(import.meta.url).resolve('@anthropic-ai/sandbox-runtime/dist/cli.js');
+/**
+ * What stops the command when the sandbox is not there and --no-sandbox was not given: `why` as the runtime says it
+ * (the tools missing on Linux, the system with none, a start that failed), and the way on for the system.
+ */
+export function sandboxRefusal(platform, why) {
+    if (platform === 'darwin')
+        return `Impeccable runs the setup's commands in macOS's sandbox, and it did not start here (${why}). Run impeccable-reviews in a terminal of your own, outside any other sandbox.`;
+    const without = 'run it with --no-sandbox, which runs them without one, with all your access';
+    if (platform === 'linux')
+        return `Impeccable runs the setup's commands in Linux's sandbox, and it did not start here (${why}). Install bubblewrap, socat and ripgrep, or ${without}.`;
+    return `Impeccable runs the setup's commands in a sandbox, and there is none for ${platform}. To go on anyway, ${without}.`;
+}
 /** Runs `true` in the sandbox: undefined when it did, else the first line of why not. */
 async function selfTest() {
     const wrapped = await SandboxManager.wrapWithSandbox('true');
@@ -167,22 +438,27 @@ const readText = (path) => {
     }
 };
 /**
- * Starts the sandbox for this run, before anything runs: on macOS a sandbox that will not start stops the command,
- * and elsewhere its commands run unsandboxed, which `warning` says once, on the first screen. From here on git
- * outside the sandbox is pinned to this checkout's folders.
+ * The caches and stores of the write list that a command in the sandbox could not make itself, which the run makes
+ * before it starts: on macOS those under a folder that is not there, since the sandbox writes the store and not the
+ * folder it goes in (pnpm's home, whose global commands are on PATH); on Linux every one not there, which bubblewrap
+ * leaves out of the list.
+ */
+export function storeFolders(o) {
+    const exists = o.exists ?? existsSync;
+    const stores = [...CACHES, ...(o.platform === 'darwin' ? MACOS.caches : [])].map((path) => join(o.home, path));
+    return stores.filter((path) => !exists(path) && (o.platform !== 'darwin' || !exists(dirname(path))));
+}
+/**
+ * Starts the sandbox for this run, before anything runs: a sandbox that is not there or will not start stops the
+ * command, unless --no-sandbox was given and this is not macOS, when its commands run unsandboxed, which `warning`
+ * says once, on the first screen. From here on git outside the sandbox is pinned to this checkout's folders, and
+ * their settings are watched.
  */
 export async function startSandbox(o) {
-    const platform = process.platform;
+    const platform = o.platform ?? process.platform;
     const home = o.home ?? homedir();
     const git = gitDirsOf(o.root);
     pinned = git;
-    // Bubblewrap denies only what is there, so the folder npx keeps its installs in is made before any command runs: a command in the sandbox never gets to make it its own.
-    try {
-        mkdirSync(join(home, '.npm', '_npx'), { recursive: true });
-    }
-    catch {
-        // A home that takes no folder takes none from a sandboxed command either.
-    }
     const worktrees = (() => {
         try {
             return readdirSync(join(git.commonDir, 'worktrees'));
@@ -191,11 +467,12 @@ export async function startSandbox(o) {
             return [];
         }
     })();
-    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees });
+    const global = scrubbedGitConfig(git.root, home, o.log);
+    const policy = sandboxPolicy({ git, scratch: realpathSync(o.scratch), home, platform, worktrees, gitConfigs: global.files });
     const files = checkoutFiles(git.root);
     const sources = { host: o.host, files, read: (path) => readText(join(git.root, path)), npmrc: readText(join(home, '.npmrc')) };
     let domains = allowedDomains({ ...sources, hosts: o.hosts() });
-    const config = { network: { allowedDomains: domains, deniedDomains: [] }, filesystem: policy };
+    const config = { network: { allowedDomains: domains, ...DENIED }, filesystem: policy };
     // Temp files land in the scratch folder: the sandbox's runtime names the folder its commands get as TMPDIR from this variable.
     const temp = join(o.scratch, 'tmp');
     mkdirSync(temp, { recursive: true });
@@ -208,11 +485,19 @@ export async function startSandbox(o) {
     else if (!SandboxManager.isSupportedPlatform())
         off = 'no sandbox for this system';
     else {
-        const missing = SandboxManager.checkDependencies().errors;
+        const missing = (o.missing ?? (() => SandboxManager.checkDependencies().errors))();
         if (missing.length)
             off = missing.join(', ');
     }
     if (!off) {
+        for (const path of storeFolders({ home, platform })) {
+            try {
+                mkdirSync(path, { recursive: true, mode: 0o700 });
+            }
+            catch (err) {
+                o.log.write('store folder not made', { path, code: err.code });
+            }
+        }
         try {
             // A host off the list is refused by the sandbox's proxy; the debug log names it, which says what a failed install or build wanted.
             await SandboxManager.initialize(config, async ({ host, port }) => {
@@ -227,21 +512,46 @@ export async function startSandbox(o) {
         if (off)
             await SandboxManager.reset().catch(() => { });
     }
-    if (off && platform === 'darwin') {
-        throw new UserError(`Impeccable runs the setup's commands in macOS's sandbox, and it did not start here (${off}). Run impeccable-reviews in a terminal of your own, outside any other sandbox.`, { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
-    }
+    // --no-sandbox goes on without one where the sandbox is not there; macOS always has its own, and stops as before.
+    if (off && !(o.noSandbox && platform !== 'darwin'))
+        throw new UserError(sandboxRefusal(platform, off), { event: 'setup_command_check_failed', outcome: 'sandbox_failed' });
     o.log.write(off ? `sandbox off: ${off}` : 'sandbox on', { domains, ...policy });
+    // Watched from before any command runs: the shell below is the first thing that runs one.
+    const watched = watchGit(git, worktrees);
     const local = createLocalBashOperations();
+    // The commands in flight, each with a way to stop it: pi kills the command's whole process tree on an abort.
+    const inFlight = new Set();
+    const exec = async (command, cwd, options) => {
+        const stop = new AbortController();
+        inFlight.add(stop);
+        try {
+            return await local.exec(command, cwd, { ...options, signal: options.signal ? AbortSignal.any([options.signal, stop.signal]) : stop.signal });
+        }
+        finally {
+            inFlight.delete(stop);
+        }
+    };
+    // A run that stops before its summary still leaves none of them behind: on exit, and on a signal, which ends the process with no exit event. The commands in flight are stopped first, so none writes after the removal. The screen, when there is one, sends the signal on after its own stop; without one it is sent on from here.
+    process.on('exit', () => void watched.settle());
+    for (const signal of ['SIGTERM', 'SIGHUP', 'SIGINT']) {
+        process.once(signal, () => {
+            for (const stop of inFlight)
+                stop.abort();
+            watched.settle();
+            if (!process.listenerCount(signal))
+                process.kill(process.pid, signal);
+        });
+    }
     let running = 0;
     const shell = {
         exec: async (command, cwd, options) => {
             const place = o.place(command);
             if (place === 'install')
-                return local.exec(command, ownFolder(), options);
+                return exec(command, ownFolder(), { ...options, env: { ...(options.env ?? process.env), ...installEnvironment() } });
             if (place === 'person')
-                return local.exec(command, cwd, { ...options, env: gitEnvironment(options.env) });
+                return exec(command, cwd, { ...options, env: gitEnvironment(options.env) });
             if (off)
-                return local.exec(command, cwd, options);
+                return exec(command, cwd, options);
             // A host's API joins the list once the person said yes to setting that host up.
             const next = allowedDomains({ ...sources, hosts: o.hosts() });
             if (next.join() !== domains.join()) {
@@ -252,7 +562,8 @@ export async function startSandbox(o) {
             const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
             running++;
             try {
-                return await local.exec(wrapped, cwd, { ...options, env: { ...(options.env ?? process.env), ...INSIDE } });
+                // Git in the sandbox reads the scrubbed copy of the global settings: the person's own are denied, and git dies on a global config it cannot read.
+                return await exec(wrapped, cwd, { ...options, env: { ...(options.env ?? process.env), ...INSIDE, ...scratchCaches(o.scratch), ...pnpmEnvironment(home, platform), GIT_CONFIG_GLOBAL: global.path } });
             }
             finally {
                 // On Linux this takes away the files bubblewrap put in place of absent denied paths: only once no command still runs on them.
@@ -261,15 +572,18 @@ export async function startSandbox(o) {
             }
         },
     };
+    const proven = "the preview job on the pull request proves a static site's build instead";
     return {
         warning: off && `${off[0].toUpperCase()}${off.slice(1)}, so the setup's commands run without a sandbox, with all your access.`,
+        noPreview: off ? `The local preview check, which needs a sandbox of its own, does not run either; ${proven}.` : platform === 'linux' ? `On Linux bubblewrap keeps the app from the local preview check, so the check does not run here; ${proven}.` : undefined,
         shell,
+        finish: () => watched.settle(),
         preview(folder) {
             if (off || platform === 'linux')
                 return null;
             const file = join(settings, `preview-${randomBytes(6).toString('hex')}.json`);
             const own = {
-                network: { allowedDomains: domains, deniedDomains: [], allowLocalBinding: true },
+                network: { allowedDomains: domains, ...DENIED, allowLocalBinding: true },
                 filesystem: { denyRead: policy.denyRead, allowWrite: [realpathSync(folder)], denyWrite: [] },
             };
             writeFileSync(file, JSON.stringify(own), { mode: 0o600 });