@machina.ai/cell-cli 1.60.0-rc1 → 1.64.0-rc2

package/dist/src/utils/sandbox-macos-permissive-open.sb

@@ -73,7 +73,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -183,3 +182,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-permissive-proxied.sb

@@ -75,7 +75,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -186,3 +185,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-profiles.test.js

@@ -96,6 +96,65 @@ describe('macOS Seatbelt container runtime isolation', () => {
         });
     });
 });
+describe('macOS Seatbelt Gemini configuration isolation', () => {
+    describe.each(ALL_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('does not allow writes to HOME_DIR/.cell-cli', () => {
+            const allowWriteMatch = rules.match(/\(allow file-write\*[\s\S]*?\n\)/);
+            expect(allowWriteMatch).not.toBeNull();
+            expect(allowWriteMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+        });
+        it('denies writing to Gemini configuration directory and sensitive files', () => {
+            expect(rules).toContain('(deny file-write*');
+            expect(rules).toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            expect(rules).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(rules).toContain('(regex #"/policy_integrity\\.json$")');
+        });
+        it('denies reading sensitive credential and environment files', () => {
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))');
+            expect(rules).toContain('(regex #"/google_accounts\\.json$")');
+            expect(rules).toContain('(regex #"/trusted_hooks\\.json$")');
+            expect(rules).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(rules).toContain('(regex #"/policy_integrity\\.json$")');
+        });
+    });
+});
+const RESTRICTIVE_AND_STRICT_PROFILES = [
+    'sandbox-macos-restrictive-open.sb',
+    'sandbox-macos-restrictive-proxied.sb',
+    'sandbox-macos-strict-open.sb',
+    'sandbox-macos-strict-proxied.sb',
+];
+describe('macOS Seatbelt non-sensitive configuration read access', () => {
+    describe.each(RESTRICTIVE_AND_STRICT_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('allows reading settings.json and keybindings.json configuration files', () => {
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))');
+            expect(rules).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))');
+        });
+    });
+});
+const STRICT_PROFILES = [
+    'sandbox-macos-strict-open.sb',
+    'sandbox-macos-strict-proxied.sb',
+];
+describe('macOS Seatbelt strict profile scoped read access', () => {
+    describe.each(STRICT_PROFILES)('%s', (profile) => {
+        const rules = readRules(profile);
+        it('does not allow broad read access to ~/.cell-cli subpath', () => {
+            const allowReadMatch = rules.match(/\(allow file-read\*[\s\S]*?\n\)/);
+            expect(allowReadMatch).not.toBeNull();
+            expect(allowReadMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+        });
+    });
+});
 describe('BUILTIN_SEATBELT_PROFILE_CONTENTS consistency', () => {
     const profileKeyMap = {
         'sandbox-macos-permissive-open.sb': 'permissive-open',
@@ -113,6 +172,40 @@ describe('BUILTIN_SEATBELT_PROFILE_CONTENTS consistency', () => {
             expect(embeddedContent).toContain('(literal "/usr/local/bin/docker")');
             expect(embeddedContent).toContain('(xpc-service-name-prefix "com.docker.")');
         });
+        it('contains Gemini config isolation and credential denial rules in embedded content', () => {
+            const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+            expect(embeddedContent).toBeDefined();
+            expect(embeddedContent).toContain('(deny file-write*');
+            expect(embeddedContent).toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            expect(embeddedContent).toContain('(regex #"/trustedFolders\\.json$")');
+            expect(embeddedContent).toContain('(regex #"/policy_integrity\\.json$")');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))');
+            expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))');
+        });
+        it('contains settings and keybindings read rules in embedded content for restrictive and strict profiles', () => {
+            if ([
+                'restrictive-open',
+                'restrictive-proxied',
+                'strict-open',
+                'strict-proxied',
+            ].includes(key)) {
+                const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+                expect(embeddedContent).toBeDefined();
+                expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))');
+                expect(embeddedContent).toContain('(literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))');
+            }
+        });
+        it('does not contain broad .cell-cli subpath read rule in embedded strict content', () => {
+            if (['strict-open', 'strict-proxied'].includes(key)) {
+                const embeddedContent = BUILTIN_SEATBELT_PROFILE_CONTENTS[key];
+                const allowReadMatch = embeddedContent.match(/\(allow file-read\*[\s\S]*?\n\)/);
+                expect(allowReadMatch).not.toBeNull();
+                expect(allowReadMatch[0]).not.toContain('(subpath (string-append (param "HOME_DIR") "/.cell-cli"))');
+            }
+        });
     });
 });
 //# sourceMappingURL=sandbox-macos-profiles.test.js.map

package/dist/src/utils/sandbox-macos-profiles.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,kCAAkC;IAClC,qCAAqC;IACrC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,6DAA6D,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,aAAa,GAA2B;QAC5C,kCAAkC,EAAE,iBAAiB;QACrD,qCAAqC,EAAE,oBAAoB;QAC3D,mCAAmC,EAAE,kBAAkB;QACvD,sCAAsC,EAAE,qBAAqB;QAC7D,8BAA8B,EAAE,aAAa;QAC7C,iCAAiC,EAAE,gBAAgB;KACpD,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAC1C,wBAAwB,EACxB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}
+{"version":3,"file":"sandbox-macos-profiles.test.js","sourceRoot":"","sources":["../../../src/utils/sandbox-macos-profiles.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,iCAAiC,EAAE,MAAM,6BAA6B,CAAC;AAEhF,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE9D;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC;SACtD,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,YAAY,GAAG;IACnB,kCAAkC;IAClC,qCAAqC;IACrC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,MAAM,mBAAmB,GAAG;IAC1B,kCAAkC;IAClC,qCAAqC;CACtC,CAAC;AAEF,gFAAgF;AAChF,4EAA4E;AAC5E,sCAAsC;AACtC,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,QAAQ,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAClD,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACjD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;YAC/C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACxC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACzD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,SAAS,CAAC,kCAAkC,CAAC,CAAC;QAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;QACpE,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,KAAK,GAAG,SAAS,CAAC,qCAAqC,CAAC,CAAC;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,wDAAwD,CACzD,CAAC;QACF,+DAA+D;QAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,0CAA0C,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,6DAA6D,CAC9D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;YACxD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,6BAA6B,CAAC,CAAC;YACvD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;YAC3C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACrD,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACxE,MAAM,CAAC,eAAe,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvC,MAAM,CAAC,eAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACvC,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;YAC9E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YAC7C,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;YACnE,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,4EAA4E,CAC7E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,mFAAmF,CACpF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,gFAAgF,CACjF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,8EAA8E,CAC/E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,+EAA+E,CAChF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,iFAAiF,CAClF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,qCAAqC,CAAC,CAAC;YAC/D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YAC9D,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,+BAA+B,GAAG;IACtC,mCAAmC;IACnC,sCAAsC;IACtC,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,QAAQ,CAAC,wDAAwD,EAAE,GAAG,EAAE;IACtE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/D,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;YAC/E,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,yEAAyE,CAC1E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CACrB,4EAA4E,CAC7E,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG;IACtB,8BAA8B;IAC9B,iCAAiC;CAClC,CAAC;AAEF,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAEjC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;YACjE,MAAM,cAAc,GAAG,KAAK,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACtE,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YACtC,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACtC,2DAA2D,CAC5D,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+CAA+C,EAAE,GAAG,EAAE;IAC7D,MAAM,aAAa,GAA2B;QAC5C,kCAAkC,EAAE,iBAAiB;QACrD,qCAAqC,EAAE,oBAAoB;QAC3D,mCAAmC,EAAE,kBAAkB;QACvD,sCAAsC,EAAE,qBAAqB;QAC7D,8BAA8B,EAAE,aAAa;QAC7C,iCAAiC,EAAE,gBAAgB;KACpD,CAAC;IAEF,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAC1C,wBAAwB,EACxB,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACZ,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;YAChE,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;YACtE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;YACvE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yCAAyC,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;YAC1F,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;YAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;YACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,CAAC;YACvD,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,2DAA2D,CAC5D,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;YACxE,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,sCAAsC,CACvC,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,4EAA4E,CAC7E,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,gFAAgF,CACjF,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,8EAA8E,CAC/E,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,+EAA+E,CAChF,CAAC;YACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,iFAAiF,CAClF,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,sGAAsG,EAAE,GAAG,EAAE;YAC9G,IACE;gBACE,kBAAkB;gBAClB,qBAAqB;gBACrB,aAAa;gBACb,gBAAgB;aACjB,CAAC,QAAQ,CAAC,GAAG,CAAC,EACf,CAAC;gBACD,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAC/D,MAAM,CAAC,eAAe,CAAC,CAAC,WAAW,EAAE,CAAC;gBACtC,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,yEAAyE,CAC1E,CAAC;gBACF,MAAM,CAAC,eAAe,CAAC,CAAC,SAAS,CAC/B,4EAA4E,CAC7E,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,IAAI,CAAC,aAAa,EAAE,gBAAgB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACpD,MAAM,eAAe,GAAG,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAC/D,MAAM,cAAc,GAAG,eAAe,CAAC,KAAK,CAC1C,iCAAiC,CAClC,CAAC;gBACF,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,cAAe,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CACtC,2DAA2D,CAC5D,CAAC;YACJ,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}

package/dist/src/utils/sandbox-macos-restrictive-open.sb

@@ -5,6 +5,10 @@
 
 ;; allow reading files from anywhere on host
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 
 ;; allow exec/fork (children inherit policy)
 (allow process-exec)
@@ -67,7 +71,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -142,3 +145,38 @@
     (ipc-posix-name-prefix "docker")
     (ipc-posix-name-prefix "com.docker.")
 )
+
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)

package/dist/src/utils/sandbox-macos-restrictive-proxied.sb

@@ -5,6 +5,10 @@
 
 ;; allow reading files from anywhere on host
 (allow file-read*)
+(allow file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
+)
 
 ;; allow exec/fork (children inherit policy)
 (allow process-exec)
@@ -67,7 +71,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -145,3 +148,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-strict-open.sb

@@ -10,7 +10,8 @@
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
     ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -102,7 +103,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -178,3 +178,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+

package/dist/src/utils/sandbox-macos-strict-proxied.sb

@@ -10,7 +10,8 @@
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
     ;; Only allow reading essential dotfiles/directories under HOME, not the entire HOME
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/settings.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/keybindings.json"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     (literal (string-append (param "HOME_DIR") "/.gitconfig"))
@@ -102,7 +103,6 @@
     (subpath (param "TARGET_DIR"))
     (subpath (param "TMP_DIR"))
     (subpath (param "CACHE_DIR"))
-    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
     (subpath (string-append (param "HOME_DIR") "/.npm"))
     (subpath (string-append (param "HOME_DIR") "/.cache"))
     ;; Allow writes to included directories from --include-directories
@@ -180,3 +180,39 @@
     (ipc-posix-name-prefix "com.docker.")
 )
 
+;; Deny writing to user's Cell CLI configuration directory and sensitive files
+(deny file-write*
+    (subpath (string-append (param "HOME_DIR") "/.cell-cli"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+;; Block reading sensitive credentials and environment files
+(deny file-read*
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/oauth_creds.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/gemini-credentials.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/mcp-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/a2a-oauth-tokens.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/google_accounts.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trusted_hooks.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/trustedFolders.json"))
+    (literal (string-append (param "HOME_DIR") "/.cell-cli/policy_integrity.json"))
+    (regex #"/oauth_creds\.json$")
+    (regex #"/gemini-credentials\.json$")
+    (regex #"/mcp-oauth-tokens\.json$")
+    (regex #"/a2a-oauth-tokens\.json$")
+    (regex #"/google_accounts\.json$")
+    (regex #"/trusted_hooks\.json$")
+    (regex #"/trustedFolders\.json$")
+    (regex #"/policy_integrity\.json$")
+    (regex #"/\.env($|\..*)")
+)
+
+