@miller-tech/uap 1.119.3 → 1.119.4

package/dist/cli/sandbox.d.ts

@@ -14,5 +14,13 @@
  *   UAP_SANDBOX_ALLOW     extra writable paths, colon-separated
  *   UAP_SANDBOX_OFF=1     bypass the sandbox entirely (run the command as-is)
  */
+/**
+ * Build the ANTHROPIC_CUSTOM_HEADERS value for a sandboxed session: append the
+ * `X-Uap-Sandbox: 1` marker (which the proxy uses to strip sandbox-unreachable
+ * MCP tools) to any pre-existing headers rather than clobbering them. Claude
+ * Code forwards this env var verbatim to its endpoint as HTTP headers
+ * (newline-separated "Name: Value" pairs).
+ */
+export declare function sandboxCustomHeaders(existing: string | undefined): string;
 export declare function sandboxCommand(command: string[]): Promise<void>;
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/cli/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAiBH,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgErE"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAOH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CASzE;AAYD,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuErE"}

package/dist/cli/sandbox.js

@@ -18,6 +18,24 @@ import { spawnSync } from 'child_process';
 import { existsSync, realpathSync } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
+/**
+ * Build the ANTHROPIC_CUSTOM_HEADERS value for a sandboxed session: append the
+ * `X-Uap-Sandbox: 1` marker (which the proxy uses to strip sandbox-unreachable
+ * MCP tools) to any pre-existing headers rather than clobbering them. Claude
+ * Code forwards this env var verbatim to its endpoint as HTTP headers
+ * (newline-separated "Name: Value" pairs).
+ */
+export function sandboxCustomHeaders(existing) {
+    const marker = 'X-Uap-Sandbox: 1';
+    const prior = existing?.trim();
+    if (!prior)
+        return marker;
+    // Idempotent: don't duplicate the marker (nested sandbox, or user pre-set it).
+    const already = prior
+        .split('\n')
+        .some((h) => h.trim().toLowerCase() === marker.toLowerCase());
+    return already ? prior : `${prior}\n${marker}`;
+}
 function fail(msg, code = 2) {
     console.error(`uap sandbox: ${msg}`);
     process.exit(code);
@@ -78,7 +96,13 @@ export async function sandboxCommand(command) {
         if (p && existsSync(p))
             args.push('--bind', p, p);
     }
-    args.push('--setenv', 'HOME', home, '--setenv', 'UAP_SANDBOX_ACTIVE', '1', '--chdir', workdir);
+    // Tell the proxy this session is sandboxed so it can strip MCP tools the
+    // bubblewrap sandbox can't reach (the claude-in-chrome browser extension
+    // socket is unreachable here — offering browser_batch guarantees dead-end
+    // loops). Claude Code forwards ANTHROPIC_CUSTOM_HEADERS verbatim to its
+    // endpoint; append rather than clobber any pre-existing value.
+    const customHeaders = sandboxCustomHeaders(process.env.ANTHROPIC_CUSTOM_HEADERS);
+    args.push('--setenv', 'HOME', home, '--setenv', 'UAP_SANDBOX_ACTIVE', '1', '--setenv', 'ANTHROPIC_CUSTOM_HEADERS', customHeaders, '--chdir', workdir);
     const r = spawnSync('bwrap', [...args, ...command], { stdio: 'inherit' });
     if (r.error)
         fail(`failed to launch bwrap: ${r.error.message}`, 127);

package/dist/cli/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,SAAS,IAAI,CAAC,GAAW,EAAE,IAAI,GAAG,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAiB;IACpD,iEAAiE;IACjE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEpD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,IAAI,CACF,8DAA8D;YAC5D,2DAA2D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC,qCAAqC,OAAO,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,wCAAwC;IACxC,MAAM,IAAI,GAAa;QACrB,WAAW,EAAE,GAAG,EAAE,GAAG;QACrB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,MAAM;QACjB,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,kBAAkB;QAClB,QAAQ,EAAE,OAAO,EAAE,OAAO;QAC1B,QAAQ,EAAE,MAAM,EAAE,MAAM;QACxB,SAAS,EAAE,UAAU;KACtB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,IAAI,CACP,UAAU,EAAE,MAAM,EAAE,IAAI,EACxB,UAAU,EAAE,oBAAoB,EAAE,GAAG,EACrC,SAAS,EAAE,OAAO,CACnB,CAAC;IAEF,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,KAAK;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/cli/sandbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA4B;IAC/D,MAAM,MAAM,GAAG,kBAAkB,CAAC;IAClC,MAAM,KAAK,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,KAAK;QAAE,OAAO,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,MAAM,OAAO,GAAG,KAAK;SAClB,KAAK,CAAC,IAAI,CAAC;SACX,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,GAAW,EAAE,IAAI,GAAG,CAAC;IACjC,OAAO,CAAC,KAAK,CAAC,gBAAgB,GAAG,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,QAAQ;IACf,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAiB;IACpD,iEAAiE;IACjE,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEpD,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC,6DAA6D,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;QAChB,IAAI,CACF,8DAA8D;YAC5D,2DAA2D,EAC7D,GAAG,CACJ,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IAC3C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7D,CAAC;IAED,8EAA8E;IAC9E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/D,IAAI,CAAC,qCAAqC,OAAO,eAAe,CAAC,CAAC;IACpE,CAAC;IAED,wCAAwC;IACxC,MAAM,IAAI,GAAa;QACrB,WAAW,EAAE,GAAG,EAAE,GAAG;QACrB,OAAO,EAAE,MAAM;QACf,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,MAAM;QACjB,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,kBAAkB;QAClB,QAAQ,EAAE,OAAO,EAAE,OAAO;QAC1B,QAAQ,EAAE,MAAM,EAAE,MAAM;QACxB,SAAS,EAAE,UAAU;KACtB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC1B,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,+DAA+D;IAC/D,MAAM,aAAa,GAAG,oBAAoB,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACjF,IAAI,CAAC,IAAI,CACP,UAAU,EAAE,MAAM,EAAE,IAAI,EACxB,UAAU,EAAE,oBAAoB,EAAE,GAAG,EACrC,UAAU,EAAE,0BAA0B,EAAE,aAAa,EACrD,SAAS,EAAE,OAAO,CACnB,CAAC;IAEF,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,CAAC,KAAK;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC9B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@miller-tech/uap",
-  "version": "1.119.3",
+  "version": "1.119.4",
   "description": "Autonomous AI agent memory system with CLAUDE.md protocol enforcement",
   "type": "module",
   "main": "dist/index.js",

package/tools/agents/scripts/anthropic_proxy.py

@@ -1275,6 +1275,7 @@ class SessionMonitor:
     and enable proactive context management before overflow occurs."""
 
     context_window: int = 0  # Auto-detected or configured
+    sandboxed: bool = False  # True when the client is a `uap sandbox` (bwrap) session (X-Uap-Sandbox header)
     total_requests: int = 0
     last_input_tokens: int = 0  # Estimated input tokens of last request
     last_output_tokens: int = 0  # Actual output tokens of last response
@@ -4366,6 +4367,46 @@ def _writes_are_gated(openai_body: dict) -> bool:
     return False
 
 
+# MCP tool prefixes a bubblewrap sandbox (`uap sandbox`) cannot reach: the
+# claude-in-chrome browser extension talks over a socket that is not bound into
+# the sandbox mount namespace, so every browser_batch call dead-ends. Offering
+# these tools to a sandboxed session guarantees a fetch/tool-selection loop.
+# Env-configurable (colon-separated) so a deployment that DOES bind the browser
+# extension socket into the sandbox can disable stripping (set empty), or extend
+# it to other sandbox-unreachable MCP servers. Default: the claude-in-chrome
+# browser bridge, empirically unreachable in the bwrap namespace (observed live:
+# browser_batch dead-ended repeatedly and the model reported it unavailable).
+_SANDBOX_UNREACHABLE_TOOL_PREFIXES = tuple(
+    p
+    for p in os.environ.get(
+        "PROXY_SANDBOX_UNREACHABLE_PREFIXES", "mcp__claude-in-chrome__"
+    ).split(":")
+    if p
+)
+
+
+def _strip_sandbox_unreachable_tools(body: dict) -> int:
+    """Drop browser/extension MCP tools a bwrap sandbox can't reach from the
+    Anthropic-format tool list in ``body['tools']``. Returns the count removed
+    so the caller can log it. The model then falls back to WebFetch / local
+    file reads instead of looping on an unreachable browser_batch."""
+    tools = body.get("tools")
+    if not isinstance(tools, list) or not _SANDBOX_UNREACHABLE_TOOL_PREFIXES:
+        return 0
+    kept = [
+        t
+        for t in tools
+        if not (
+            isinstance(t, dict)
+            and str(t.get("name", "")).startswith(_SANDBOX_UNREACHABLE_TOOL_PREFIXES)
+        )
+    ]
+    removed = len(tools) - len(kept)
+    if removed:
+        body["tools"] = kept
+    return removed
+
+
 def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> None:
     """Force a terminal turn when the model is looping self-awarely or hammering
     a rate-limited API. Unlike the cycle-breaker (which narrows tools), this
@@ -4379,11 +4420,18 @@ def _maybe_inject_stuck_break(openai_body: dict, monitor: "SessionMonitor") -> N
     # Release the tool-choice coercion so a plain text turn is allowed.
     if openai_body.get("tool_choice") == "required":
         openai_body["tool_choice"] = "auto"
+    # Sandboxed sessions can't reach the browser extension, so don't steer them
+    # to it (that is the very dead-end this guard is trying to break).
+    channel_hint = (
+        "use `git clone` (git protocol) or WebFetch"
+        if monitor.sandboxed
+        else "use the browser tool or `git clone` (git protocol)"
+    )
     directive = (
         "\n\nSTOP — you are repeating a failing action (" + reason + "). Do NOT "
         "retry the same tool or fetch again. If a resource is unreachable (e.g. a "
-        "rate-limited GitHub REST API), switch channel: use the browser tool or "
-        "`git clone` (git protocol), NOT api.github.com. If it is still "
+        "rate-limited GitHub REST API), switch channel: " + channel_hint + ", NOT "
+        "api.github.com. If it is still "
         "unavailable, proceed WITHOUT it using what you already have, or ask the "
         "operator the single blocking question in one sentence. Take a DIFFERENT "
         "action now."
@@ -9278,6 +9326,21 @@ async def messages(request: Request):
     if request.headers.get("x-uap-json-response"):
         body["_uap_json_response"] = True
 
+    # Sandboxed sessions (`uap sandbox` / bwrap) set X-Uap-Sandbox:1 via
+    # ANTHROPIC_CUSTOM_HEADERS. The sandbox can't reach the claude-in-chrome
+    # browser extension, so strip its MCP tools here (before passthrough, so it
+    # applies to local AND cloud sessions) — the model then uses WebFetch or
+    # local file reads instead of looping on an unreachable browser_batch.
+    sandboxed = (request.headers.get("x-uap-sandbox") or "").strip() == "1"
+    if sandboxed:
+        _stripped = _strip_sandbox_unreachable_tools(body)
+        if _stripped:
+            logger.warning(
+                "SANDBOX: stripped %d unreachable browser MCP tool(s) "
+                "(bwrap cannot reach the claude-in-chrome extension)",
+                _stripped,
+            )
+
     # Periodically re-detect context window from upstream (handles server restarts)
     await _maybe_recheck_context_window()
 
@@ -9286,6 +9349,7 @@ async def messages(request: Request):
         return await _passthrough_anthropic_request(request, body, is_stream)
     session_id = resolve_session_id(request, body)
     monitor = get_session_monitor(session_id)
+    monitor.sandboxed = sandboxed
     # Per-turn flag: only the turn whose breaker strips tools suppresses the
     # response-side prose->tool_call resurrection. Clear it at request entry so a
     # prior finalize turn never bleeds into the next turn's normal extraction.

package/tools/agents/tests/test_sandbox_tool_strip.py

@@ -0,0 +1,36 @@
+"""Tests for sandbox browser-tool stripping (bwrap can't reach the extension)."""
+import importlib.util
+import unittest
+from pathlib import Path
+
+proxy_path = Path(__file__).resolve().parents[3] / "tools" / "agents" / "scripts" / "anthropic_proxy.py"
+spec = importlib.util.spec_from_file_location("anthropic_proxy", proxy_path)
+ap = importlib.util.module_from_spec(spec)
+spec.loader.exec_module(ap)
+
+
+class StripSandboxToolsTest(unittest.TestCase):
+    def test_strips_browser_mcp_tools_keeps_the_rest(self):
+        body = {"tools": [
+            {"name": "Bash"},
+            {"name": "mcp__claude-in-chrome__browser_batch"},
+            {"name": "mcp__claude-in-chrome__navigate"},
+            {"name": "WebFetch"},
+        ]}
+        removed = ap._strip_sandbox_unreachable_tools(body)
+        self.assertEqual(removed, 2)
+        self.assertEqual([t["name"] for t in body["tools"]], ["Bash", "WebFetch"])
+
+    def test_keeps_all_when_no_browser_tools(self):
+        body = {"tools": [{"name": "Bash"}, {"name": "WebFetch"}]}
+        self.assertEqual(ap._strip_sandbox_unreachable_tools(body), 0)
+        self.assertEqual(len(body["tools"]), 2)
+
+    def test_missing_or_null_tools_is_safe(self):
+        self.assertEqual(ap._strip_sandbox_unreachable_tools({}), 0)
+        self.assertEqual(ap._strip_sandbox_unreachable_tools({"tools": None}), 0)
+        self.assertEqual(ap._strip_sandbox_unreachable_tools({"tools": []}), 0)
+
+
+if __name__ == "__main__":
+    unittest.main()