@machina.ai/cell-cli 1.60.0-rc1 → 1.64.0-rc1

package/dist/src/utils/sandbox-macos-profiles.test.js

@@ -96,6 +96,65 @@ describe('macOS Seatbelt container runtime isolation', () => {
         });
     });
 });
+describe('macOS Seatbelt Gemini configuration isolation', () => {
+    describe.each(ALL_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('does not allow writes to HOME_DIR/.cell-cli', () => {
+            const allowWriteMatch = rules.match(/\(allow file-write\*[\s\S]*?\n\)/);
+            expect(allowWriteMatch).not.toBeNull();
+            expect(allowWriteMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+        });
+        it('denies writing to Gemini configuration directory and sensitive files', () => {
+            expect(rules).toContain('(deny file-write*');
+            expect(rules).toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            expect(rules).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(rules).toContain('(regex #"/policy_integrity\\.json$")');
+        });
+        it('denies reading sensitive credential and environment files', () => {
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))');
+            expect(rules).toContain('(regex #"/google_accounts\\.json$")');
+            expect(rules).toContain('(regex #"/trusted_hooks\\.json$")');
+            expect(rules).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(rules).toContain('(regex #"/policy_integrity\\.json$")');
+        });
+    });
+});
+const RESTRICTIVE_AND_STRICT_PROFILES = [
+    'sandbox-macos-restrictive-open.sb',
+    'sandbox-macos-restrictive-proxied.sb',
+    'sandbox-macos-strict-open.sb',
+    'sandbox-macos-strict-proxied.sb',
+];
+describe('macOS Seatbelt non-sensitive configuration read access', () => {
+    describe.each(RESTRICTIVE_AND_STRICT_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('allows reading settings.json and keybindings.json configuration files', () => {
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))');
+        });
+    });
+});
+const STRICT_PROFILES = [
+    'sandbox-macos-strict-open.sb',
+    'sandbox-macos-strict-proxied.sb',
+];
+describe('macOS Seatbelt strict profile scoped read access', () => {
+    describe.each(STRICT_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('does not allow broad read access to ~/.cell-cli subpath', () => {
+            const allowReadMatch = rules.match(/\(allow file-read\*[\s\S]*?\n\)/);
+            expect(allowReadMatch).not.toBeNull();
+            expect(allowReadMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+        });
+    });
+});
 describe('BUILTIN_SEATBELT_PROFILE_CONTENTS consistency', () => {
     const profileKeyMap = {
         'sandbox-macos-permissive-open.sb': 'permissive-open',
@@ -113,6 +172,40 @@ describe('BUILTIN_SEATBELT_PROFILE_CONTENTS consistency', () => {
             expect(embeddedContent).toContain('(literal "/usr/local/bin/docker")');
             expect(embeddedContent).toContain('(xpc-service-name-prefix "com.docker.")');
         });
+        it('contains Gemini config isolation and credential denial rules in embedded content', () => {
+            const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+            expect(embeddedContent).toBeDefined();
+            expect(embeddedContent).toContain('(deny file-write*');
+            expect(embeddedContent).toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            expect(embeddedContent).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(embeddedContent).toContain('(regex #"/policy_integrity\\.json$")');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))');
+        });
+        it('contains settings and keybindings read rules in embedded content for restrictive and strict profiles', () => {
+            if ([
+                'restrictive-open',
+                'restrictive-proxied',
+                'strict-open',
+                'strict-proxied',
+            ].includes(key)) {
+                const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+                expect(embeddedContent).toBeDefined();
+                expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))');
+                expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))');
+            }
+        });
+        it('does not contain broad .cell-cli subpath read rule in embedded strict content', () => {
+            if (['strict-open', 'strict-proxied'].includes(key)) {
+                const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+                const allowReadMatch = embeddedContent.match(/\(allow file-read\*[\s\S]*?\n\)/);
+                expect(allowReadMatch).not.toBeNull();
+                expect(allowReadMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            }
+        });
     });
 });
 //# sourceMappingURL=sandbox-macos-profiles.test.js.map

package/dist/src/utils/sandbox-macos-profiles.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,kCAAkC;IAClC,qCAAqC;IACrC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,6DAA6D,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,aAAa,GAA2B;QAC5C,kCAAkC,EAAE,iBAAiB;QACrD,qCAAqC,EAAE,oBAAoB;QAC3D,mCAAmC,EAAE,kBAAkB;QACvD,sCAAsC,EAAE,qBAAqB;QAC7D,8BAA8B,EAAE,aAAa;QAC7C,iCAAiC,EAAE,gBAAgB;KACpD,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAC1C,wBAAwB,EACxB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,kCAAkC;IAClC,qCAAqC;IACrC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,6DAA6D,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxE,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,eAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACvC,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;YAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,4EAA4E,CAC7E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,mFAAmF,CACpF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,gFAAgF,CACjF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,8EAA8E,CAC/E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,+EAA+E,CAChF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG;IACtC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,yEAAyE,CAC1E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,4EAA4E,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACtE,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACtC,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,aAAa,GAA2B;QAC5C,kCAAkC,EAAE,iBAAiB;QACrD,qCAAqC,EAAE,oBAAoB;QAC3D,mCAAmC,EAAE,kBAAkB;QACvD,sCAAsC,EAAE,qBAAqB;QAC7D,8BAA8B,EAAE,aAAa;QAC7C,iCAAiC,EAAE,gBAAgB;KACpD,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAC1C,wBAAwB,EACxB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;YAC1F,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YACxE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,4EAA4E,CAC7E,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,gFAAgF,CACjF,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,8EAA8E,CAC/E,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,+EAA+E,CAChF,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,iFAAiF,CAClF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sGAAsG,EAAE,GAAG,EAAE;YAC9G,IACE;gBACE,kBAAkB;gBAClB,qBAAqB;gBACrB,aAAa;gBACb,gBAAgB;aACjB,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,CAAC;gBACD,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yEAAyE,CAC1E,CAAC;gBACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,4EAA4E,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAC/D,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAC1C,iCAAiC,CAClC,CAAC;gBACF,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACtC,2DAA2D,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/src/utils/sandbox-macos-restrictive-open.sb

@@ -5,6 +5,10 @@
 
 ;; allow reading files from anywhere on host
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 
 ;; allow exec/fork (children inherit policy)
 (allow process-exec)
@@ -67,7 +71,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -142,3 +145,38 @@
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
 )
+
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)

package/dist/src/utils/sandbox-macos-restrictive-proxied.sb

@@ -5,6 +5,10 @@
 
 ;; allow reading files from anywhere on host
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 
 ;; allow exec/fork (children inherit policy)
 (allow process-exec)
@@ -67,7 +71,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -145,3 +148,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-strict-open.sb

@@ -10,7 +10,8 @@
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
     ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -102,7 +103,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -178,3 +178,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-strict-proxied.sb

@@ -10,7 +10,8 @@
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
     ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -102,7 +103,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -180,3 +180,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox.js

@@ -10,11 +10,15 @@ import os from 'node:os';
 import { fileURLToPath } from 'node:url';
 import { quote, parse } from 'shell-quote';
 import { promisify } from 'node:util';
-import { coreEvents, debugLogger, FatalSandboxError, CELL_DIR, homedir, } from '@google/gemini-cli-core';
+import { coreEvents, debugLogger, FatalSandboxError, CELL_DIR, homedir, resolveToRealPath, } from '@google/gemini-cli-core';
 import { ConsolePatcher } from '../ui/utils/ConsolePatcher.js';
 import { randomBytes } from 'node:crypto';
-import { getContainerPath, shouldUseCurrentUserInSandbox, parseImageName, ports, entrypoint, LOCAL_DEV_SANDBOX_IMAGE_NAME, SANDBOX_NETWORK_NAME, SANDBOX_PROXY_NAME, BUILTIN_SEATBELT_PROFILES, prepareIsolatedSettingsDir, } from './sandboxUtils.js';
+import stripJsonComments from 'strip-json-comments';
+import { getContainerPath, shouldUseCurrentUserInSandbox, parseImageName, ports, entrypoint, LOCAL_DEV_SANDBOX_IMAGE_NAME, SANDBOX_NETWORK_NAME, SANDBOX_PROXY_NAME, BUILTIN_SEATBELT_PROFILES, isSensitiveHostPath, sanitizeSettingsForSandbox, } from './sandboxUtils.js';
 import { BUILTIN_SEATBELT_PROFILE_CONTENTS } from './sandboxBuiltinProfiles.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
 export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs = []) {
@@ -26,20 +30,7 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
     let stopProxy = undefined;
     let tempProfileFile = null;
     let sandboxTmpDir = null;
-    let isolatedSettingsDir = null;
     const cleanup = () => {
-        if (isolatedSettingsDir) {
-            const dirToDelete = isolatedSettingsDir;
-            isolatedSettingsDir = null;
-            try {
-                if (fs.existsSync(dirToDelete)) {
-                    fs.rmSync(dirToDelete, { recursive: true, force: true });
-                }
-            }
-            catch {
-                // ignore
-            }
-        }
         if (sandboxTmpDir) {
             const dirToDelete = sandboxTmpDir;
             sandboxTmpDir = null;
@@ -100,11 +91,15 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
             if (!BUILTIN_SEATBELT_PROFILES.includes(profile)) {
                 const safeProfile = path.basename(profile);
                 const fileName = `sandbox-macos-${safeProfile}.sb`;
-                const userProfileFile = path.join(homedir(), CELL_DIR, fileName);
+                const userHome = homedir();
+                const userProfileFile = userHome
+                    ? path.join(userHome, CELL_DIR, fileName)
+                    : '';
                 const projectProfileFile = path.join(CELL_DIR, fileName);
-                profileFile = fs.existsSync(userProfileFile)
-                    ? userProfileFile
-                    : projectProfileFile;
+                profileFile =
+                    userProfileFile && fs.existsSync(userProfileFile)
+                        ? userProfileFile
+                        : projectProfileFile;
             }
             else {
                 // For builtin profiles, if the file doesn't exist on disk (e.g. bundled or bazel environments),
@@ -138,12 +133,32 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
                     ...(process.env['DEBUG'] ? ['--inspect-brk'] : []),
                     ...nodeArgs,
                 ].join(' ');
+                const targetDir = fs.realpathSync(process.cwd());
+                if (isSensitiveHostPath(targetDir)) {
+                    throw new FatalSandboxError(`Running sandbox from a sensitive host directory '${targetDir}' is strictly prohibited`);
+                }
                 const hostTmpDir = fs.realpathSync(os.tmpdir());
                 const resolvedTmpDir = fs.mkdtempSync(path.join(hostTmpDir, 'cell-sandbox-'));
+                try {
+                    fs.chmodSync(resolvedTmpDir, 0o700);
+                }
+                catch {
+                    // Silently ignore permission errors on non-POSIX filesystems
+                }
                 sandboxTmpDir = resolvedTmpDir;
+                const userHome = homedir();
+                if (userHome) {
+                    const seatbeltCacheDir = path.join(userHome, '.cache', CELL_DIR);
+                    try {
+                        fs.mkdirSync(seatbeltCacheDir, { recursive: true });
+                    }
+                    catch {
+                        // Silently ignore directory creation failures
+                    }
+                }
                 const args = [
                     '-D',
-                    `TARGET_DIR=${fs.realpathSync(process.cwd())}`,
+                    `TARGET_DIR=${targetDir}`,
                     '-D',
                     `TMP_DIR=${resolvedTmpDir}`,
                     '-D',
@@ -154,15 +169,27 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
                 // Add included directories from the workspace context
                 // Always add 5 INCLUDE_DIR parameters to ensure .sb files can reference them
                 const MAX_INCLUDE_DIRS = 5;
-                const targetDir = fs.realpathSync(cliConfig?.getTargetDir() || '');
+                const configTargetDir = cliConfig?.getTargetDir()
+                    ? resolveToRealPath(cliConfig.getTargetDir())
+                    : targetDir;
+                if (cliConfig?.getTargetDir() && isSensitiveHostPath(configTargetDir)) {
+                    throw new FatalSandboxError(`Running sandbox from a sensitive host directory '${configTargetDir}' is strictly prohibited`);
+                }
                 const includedDirs = [];
                 if (cliConfig) {
                     const workspaceContext = cliConfig.getWorkspaceContext();
                     const directories = workspaceContext.getDirectories();
                     // Filter out TARGET_DIR
                     for (const dir of directories) {
-                        const realDir = fs.realpathSync(dir);
-                        if (realDir !== targetDir) {
+                        const realDir = resolveToRealPath(dir);
+                        if (!realDir) {
+                            continue;
+                        }
+                        if (realDir !== targetDir && realDir !== configTargetDir) {
+                            if (isSensitiveHostPath(realDir)) {
+                                debugLogger.warn(`Skipping sensitive workspace directory '${realDir}' in sandbox`);
+                                continue;
+                            }
                             includedDirs.push(realDir);
                         }
                     }
@@ -174,7 +201,13 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
                             path.isAbsolute(hostPath) &&
                             fs.existsSync(hostPath)) {
                             const realDir = fs.realpathSync(hostPath);
-                            if (!includedDirs.includes(realDir) && realDir !== targetDir) {
+                            if (!includedDirs.includes(realDir) &&
+                                realDir !== targetDir &&
+                                realDir !== configTargetDir) {
+                                if (isSensitiveHostPath(realDir)) {
+                                    debugLogger.warn(`Skipping sensitive path '${realDir}' in config.allowedPaths`);
+                                    continue;
+                                }
                                 includedDirs.push(realDir);
                             }
                         }
@@ -350,32 +383,58 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
         // allow access to host.docker.internal
         args.push('--add-host', 'host.docker.internal:host-gateway');
         // mount current directory as working directory in sandbox (set via --workdir)
-        args.push('--volume', `${workdir}:${containerWorkdir}`);
-        // mount user settings directory inside container, after creating if missing
-        // note user/home changes inside sandbox and we mount at BOTH paths for consistency
-        const userHomeDirOnHost = homedir();
-        const userSettingsDirInSandbox = getContainerPath(`/home/node/${CELL_DIR}`);
-        if (!fs.existsSync(userHomeDirOnHost)) {
-            fs.mkdirSync(userHomeDirOnHost, { recursive: true });
+        if (isSensitiveHostPath(workdir)) {
+            throw new FatalSandboxError(`Running sandbox from a sensitive host directory '${workdir}' is strictly prohibited`);
         }
-        const userSettingsDirOnHost = path.join(userHomeDirOnHost, CELL_DIR);
-        if (!fs.existsSync(userSettingsDirOnHost)) {
-            fs.mkdirSync(userSettingsDirOnHost, { recursive: true });
+        if (cliConfig?.getTargetDir() &&
+            isSensitiveHostPath(cliConfig.getTargetDir())) {
+            throw new FatalSandboxError(`Running sandbox from a sensitive host directory '${cliConfig.getTargetDir()}' is strictly prohibited`);
         }
-        isolatedSettingsDir = prepareIsolatedSettingsDir(userSettingsDirOnHost);
-        args.push('--volume', `${isolatedSettingsDir}:${userSettingsDirInSandbox}`);
-        if (userSettingsDirInSandbox !== getContainerPath(userSettingsDirOnHost)) {
-            args.push('--volume', `${isolatedSettingsDir}:${getContainerPath(userSettingsDirOnHost)}`);
+        args.push('--volume', `${workdir}:${containerWorkdir}`);
+        // Create ephemeral sandbox temp directory on host for sanitized configuration files
+        if (!sandboxTmpDir) {
+            const hostTmpDir = fs.realpathSync(os.tmpdir());
+            sandboxTmpDir = fs.mkdtempSync(path.join(hostTmpDir, 'cell-sandbox-'));
+            try {
+                fs.chmodSync(sandboxTmpDir, 0o700);
+            }
+            catch {
+                // Silently ignore permission errors on non-POSIX filesystems
+            }
         }
-        // mount os.tmpdir() as os.tmpdir() inside container
-        args.push('--volume', `${os.tmpdir()}:${getContainerPath(os.tmpdir())}`);
-        // mount homedir() as homedir() inside container
-        if (userHomeDirOnHost !== os.homedir()) {
-            args.push('--volume', `${userHomeDirOnHost}:${getContainerPath(userHomeDirOnHost)}`);
+        // Sanitize user settings before mounting into the sandbox container.
+        // We STRICTLY do NOT mount ~/.cell-cli root directory or sensitive credential files
+        // (oauth_creds.json, .env, etc.). We only mount the sanitized settings file as read-only (:ro).
+        const userHomeDirOnHost = homedir();
+        let rawSettings = {};
+        if (userHomeDirOnHost) {
+            const userSettingsFileOnHost = path.join(userHomeDirOnHost, CELL_DIR, 'settings.json');
+            if (fs.existsSync(userSettingsFileOnHost)) {
+                try {
+                    const rawContent = fs.readFileSync(userSettingsFileOnHost, 'utf8');
+                    const parsed = JSON.parse(stripJsonComments(rawContent));
+                    if (isRecord(parsed)) {
+                        rawSettings = parsed;
+                    }
+                }
+                catch (err) {
+                    debugLogger.warn(`Failed to parse host user settings for sandbox: ${err}`);
+                }
+            }
         }
+        const sanitizedSettings = sanitizeSettingsForSandbox(rawSettings);
+        const sanitizedSettingsFile = path.join(sandboxTmpDir, 'settings.json');
+        fs.writeFileSync(sanitizedSettingsFile, JSON.stringify(sanitizedSettings, null, 2), { mode: 0o600 });
+        // Mount isolated sanitized settings directory inside container
+        const userSettingsDirInSandbox = getContainerPath(`/home/node/${CELL_DIR}`);
+        // Force HOME to /home/node inside the container so that the isolated settings are correctly resolved
+        args.push('--env', 'HOME=/home/node');
+        args.push('--volume', `${sandboxTmpDir}:${userSettingsDirInSandbox}:rw`);
         // mount gcloud config directory if it exists
-        const gcloudConfigDir = path.join(homedir(), '.config', 'gcloud');
-        if (fs.existsSync(gcloudConfigDir)) {
+        const gcloudConfigDir = userHomeDirOnHost
+            ? path.join(userHomeDirOnHost, '.config', 'gcloud')
+            : '';
+        if (gcloudConfigDir && fs.existsSync(gcloudConfigDir)) {
             args.push('--volume', `${gcloudConfigDir}:${getContainerPath(gcloudConfigDir)}:ro`);
         }
         // mount ADC file if GOOGLE_APPLICATION_CREDENTIALS is set
@@ -399,6 +458,9 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
                     if (!path.isAbsolute(from)) {
                         throw new FatalSandboxError(`Path '${from}' listed in SANDBOX_MOUNTS must be absolute`);
                     }
+                    if (isSensitiveHostPath(from)) {
+                        throw new FatalSandboxError(`Mounting sensitive host path '${from}' listed in SANDBOX_MOUNTS is strictly prohibited`);
+                    }
                     // check that from path exists on host
                     if (!fs.existsSync(from)) {
                         throw new FatalSandboxError(`Missing mount path '${from}' listed in SANDBOX_MOUNTS`);
@@ -412,6 +474,10 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
         if (config.allowedPaths) {
             for (const hostPath of config.allowedPaths) {
                 if (hostPath && path.isAbsolute(hostPath) && fs.existsSync(hostPath)) {
+                    if (isSensitiveHostPath(hostPath)) {
+                        debugLogger.warn(`Skipping sensitive path '${hostPath}' in config.allowedPaths`);
+                        continue;
+                    }
                     const containerPath = getContainerPath(hostPath);
                     debugLogger.log(`Config allowedPath: ${hostPath} -> ${containerPath} (ro)`);
                     args.push('--volume', `${hostPath}:${containerPath}:ro`);
@@ -619,8 +685,8 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
             finalEntrypoint[2] = defensiveEntrypoint;
             // We still need userFlag for the simpler proxy container, which does not have this issue.
             userFlag = `--user ${uid}:${gid}`;
-            // When forcing a UID in the sandbox, $HOME can be reset to '/', so we copy $HOME as well.
-            args.push('--env', `HOME=${homedir()}`);
+            // When forcing a UID in the sandbox, $HOME can be reset to '/', so ensure $HOME is set to /home/node.
+            args.push('--env', 'HOME=/home/node');
         }
         // push container image name
         args.push(image);
@@ -725,6 +791,9 @@ export async function start_sandbox(config, nodeArgs = [], cliConfig, cliArgs =
 async function start_lxc_sandbox(config, nodeArgs = [], cliArgs = []) {
     const containerName = config.image || 'cell-sandbox';
     const workdir = path.resolve(process.cwd());
+    if (isSensitiveHostPath(workdir)) {
+        throw new FatalSandboxError(`Running sandbox from a sensitive host directory '${workdir}' is strictly prohibited`);
+    }
     debugLogger.log(`starting lxc sandbox (container: ${containerName}, workdir: ${workdir}) ...`);
     // Verify the container exists and is running.
     let listOutput;
@@ -804,6 +873,10 @@ async function start_lxc_sandbox(config, nodeArgs = [], cliArgs = []) {
         if (config.allowedPaths) {
             for (const hostPath of config.allowedPaths) {
                 if (hostPath && path.isAbsolute(hostPath) && fs.existsSync(hostPath)) {
+                    if (isSensitiveHostPath(hostPath)) {
+                        debugLogger.warn(`Skipping sensitive path '${hostPath}' in config.allowedPaths for LXC`);
+                        continue;
+                    }
                     const allowedDeviceName = `gemini-allowed-${randomBytes(4).toString('hex')}`;
                     devicesToRemove.push(allowedDeviceName);
                     try {