@prestyj/cli 5.13.0 → 5.16.1

package/dist/core/prompt-commands.js

@@ -15,11 +15,6 @@ const CLAUDE_MD_RESTART_NOTICE = IS_EZ_APP
     : "> ⚠️ The project context file was created/updated. ezcoder loads it at startup, so **exit and restart ezcoder** (`/quit` then run `ezcoder` again) before continuing. Without a restart, I won't see the new context.";
 /** Shared sub-agent fan-out phrasing. */
 const spawnParallel = (count) => `in parallel using the subagent tool (call the subagent tool ${count} times in a single response)`;
-/**
- * Kencode-search ships behind deferred MCP loading, so tell commands how to
- * promote it before naming one of its tools.
- */
-const KENCODE_UNLOCK_NOTE = 'If the `mcp__kencode-search__*` tools aren\'t active yet, call `tool_search` (e.g. "search public code") first to unlock them.';
 export const PROMPT_COMMANDS = [
     {
         name: "goal",
@@ -78,7 +73,7 @@ For every candidate from the sub-agents, validate it yourself before reporting:
 1. Confirm the external source is relevant to this project and fresh enough (normally within 6 months).
 2. Search this repo with grep/find and language-aware anchors to confirm the feature is not already present under another name.
 3. Check routes, CLI commands, UI surfaces, package exports, config, docs, and examples before calling a feature missing.
-4. Use mcp__kencode-search__searchCode when a code-level look clarifies how peers actually ship the feature. Use literal imports, functions, config keys, CLI flags, route names, or package names — not conceptual phrases. ${KENCODE_UNLOCK_NOTE}
+4. Use the \`steroids\` tool (\`search\`, then \`show\` to read the full file) when a code-level look clarifies how peers actually ship the feature. Use literal imports, functions, config keys, CLI flags, route names, or package names — not conceptual phrases.
 5. Drop anything already present, irrelevant, too vague, too stale, or that is not a real user-facing feature.
 6. Merge duplicates and keep only the most exciting 5–10 features.
 
@@ -98,18 +93,18 @@ Rules:
 - Keep each cell concise but specific enough to be actionable.
 - If no exciting validated features are found, output one row saying no fresh validated features were found.
 
-After the table, ask exactly:
+After the table, ask the user what to do with the \`ask_user\` tool: one \`choice\` question (\`id: "scope"\`, question "What should I do?") with these options, each carrying a one-line hint:
 
-What should I do?
-A) Build all of these features in plan mode
-B) Build only the top priority ones in plan mode
-C) Other
+- Build all of these features in plan mode
+- Build only the top priority ones in plan mode
+
+Leave the free-text escape on so they can pick specific ranks or re-scope. The card is the ONLY ask: do not also list the options as text, and do not end with an asking line. Only if \`ask_user\` is unavailable, ask the same question in prose as a lettered list.
 
 Do not start implementing until the user chooses.
 
-If the user chooses A or B, do not implement directly. First call the enter_plan tool, then research and design an implementation plan for the selected features (all of them for A; the top 3 most exciting — ranks 1-3 — for B). The plan must cover, per feature: the user-facing behavior, the local files/anchors it touches, the implementation approach (compared against real-world examples via kencode search using literal code tokens), and how it will be verified. Write the plan to .ezcoder/plans/<name>.md, then call exit_plan with the plan path so the user can review and approve it. Do not begin implementing until the user approves the plan.
+If they choose all or the top ones, do not implement directly. First call the enter_plan tool, then research and design an implementation plan for the selected features (all of them, or the top 3 most exciting — ranks 1-3). The plan must cover, per feature: the user-facing behavior, the local files/anchors it touches, the implementation approach (compared against real-world examples via the steroids tool using literal code tokens), and how it will be verified. Write the plan to .ezcoder/plans/<name>.md, then call exit_plan with the plan path so the user can review and approve it. Do not begin implementing until the user approves the plan.
 
-If the user chooses C, ask what they would like — pick specific features by rank, refine or re-scope the list, or skip — and do not implement anything until they say so.`,
+If they answer with anything else, follow what they asked — specific features by rank, a refined or re-scoped list, or skipping — and do not implement anything until they say so.`,
     },
     {
         name: "raise-floor",
@@ -197,7 +192,7 @@ If the user chooses A, B, or C, do not fix directly. Add one task per selected f
 
 End EVERY task's standalone prompt with this exact line, verbatim, on its own line:
 
-use kencode to reference working code. /commit when done.
+use steroids to reference working code. /commit when done.
 
 After adding the tasks, tell the user exactly: "Tasks added. Press Ctrl+T to open the task list and run them." Do not begin executing them unless the user explicitly says so.
 
@@ -209,7 +204,7 @@ If the user chooses D, stop after the report.
 - **Existing features only.** Net-new capability is /expand; security is /bullet-proof; pure refactors/tooling are out of scope.
 - **No finding without a concrete, code-grounded first-run scenario.** No "could be polished" nudges.
 - **Report-first.** No edits, installs, or commits until the user picks an option.
-- **Every generated task must end with the exact line:** use kencode to reference working code. /commit when done.`,
+- **Every generated task must end with the exact line:** use steroids to reference working code. /commit when done.`,
     },
     {
         name: "test-drive",
@@ -257,7 +252,7 @@ For every bug, decide one of two paths:
 **A) BLOCKING — it stops you from testing further.** The app won't start, a screen crashes, a flow can't be completed, or a broken gate hides everything behind it. You cannot meaningfully continue the test pass until it's fixed. **Fix these immediately**, right now, so you can keep testing:
 
 1. Reproduce it and find the root cause in the code.
-2. Use the \`mcp__kencode-search__searchCode\` tool to reference how real projects implement the same pattern correctly, and base your fix on that working code. (If the kencode-search MCP tool isn't connected, note that and fix using project conventions + authoritative docs.)
+2. Use the \`steroids\` tool (\`search\`, then \`show\`) to reference how real projects implement the same pattern correctly, and base your fix on that working code. (If the tool isn't available, fix using project conventions and authoritative docs.)
 3. Implement the fix, then re-run the app and CONFIRM with your eyes (re-screenshot / re-read output) that the bug is actually gone.
 4. Commit the fix by running the \`/commit\` command, so each fix lands on working, committed code before you continue.
 5. Resume the test pass from where you were blocked.
@@ -278,9 +273,9 @@ For every deferrable bug (or a tightly-coupled group), add one task with the \`t
 
 End EVERY task's standalone prompt with this exact line, verbatim, on its own line:
 
-use kencode to reference working code. /commit when done.
+use steroids to reference working code. /commit when done.
 
-That line guarantees the next agent bases its fix on real working code (via the kencode MCP) and commits it.
+That line guarantees the next agent bases its fix on real working code (via steroids) and commits it.
 
 ## Phase 4: Report
 
@@ -297,9 +292,9 @@ Then tell the user exactly: "Tasks added. Press Ctrl+T to open the task list and
 - **Actually run the app and look.** Don't claim a screen works without observing it — a screenshot, captured output, or log line. No "this should work." But observation alone is not a filed bug: confirming a defect requires tracing the cause, which means reading the code/data/inputs.
 - **Trace cause before filing.** A symptom is not a bug until you've traced it to a code defect and ruled out bad seed/test/mock data, misconfig, and expected behavior. For numeric/calculation bugs, reproduce the arithmetic from the underlying inputs.
 - **An AI/agent (or the model itself) noticing something looks wrong is NOT evidence** — a model flags "big number vs small position" the same way whether the cause is data or logic. Only reproduced behavior plus a traced cause counts.
-- **Only fix what blocks you.** Blocking bugs get fixed inline (kencode-referenced + \`/commit\`); everything else becomes a task. When in doubt, defer.
-- **Every fix is on working, committed code** — reference real code via kencode, verify the fix by re-running, then \`/commit\`.
-- **Every filed task ends with the exact line:** use kencode to reference working code. /commit when done.
+- **Only fix what blocks you.** Blocking bugs get fixed inline (steroids-referenced + \`/commit\`); everything else becomes a task. When in doubt, defer.
+- **Every fix is on working, committed code** — reference real code via steroids, verify the fix by re-running, then \`/commit\`.
+- **Every filed task ends with the exact line:** use steroids to reference working code. /commit when done.
 - **File only reproduced bugs with a traced root cause.** No speculative or "could be improved" tasks, and no symptoms with an unverified cause — this is a bug hunt, not a polish wishlist.`,
     },
     {
@@ -398,7 +393,7 @@ If the user chooses A, B, or C, do not delete directly. Add one task per selecte
 
 End EVERY task's standalone prompt with this exact line, verbatim, on its own line:
 
-use kencode to reference working code. /commit when done.
+use steroids to reference working code. /commit when done.
 
 After adding the tasks, tell the user exactly: "Tasks added. Press Ctrl+T to open the task list and run them." Do not begin executing them unless the user explicitly says so.
 
@@ -412,7 +407,7 @@ If the user chooses D, stop after the report.
 - **App-wide first, specific areas second** — in both the hunt and the ledger.
 - **No deletion without code-grounded evidence** that the thing is dead weight (no callers / write-only / unreachable / redundant). No "feels bloated" nudges.
 - **Report-first. No deletions, edits, installs, or commits until the user picks an option.**
-- **Every generated task must end with the exact line:** use kencode to reference working code. /commit when done.`,
+- **Every generated task must end with the exact line:** use steroids to reference working code. /commit when done.`,
     },
     {
         name: "elon-2",
@@ -511,7 +506,7 @@ If the user chooses A, B, or C, do not implement directly. Add one task per sele
 
 End EVERY task's standalone prompt with this exact line, verbatim, on its own line:
 
-use kencode to reference working code. /commit when done.
+use steroids to reference working code. /commit when done.
 
 After adding the tasks, tell the user exactly: "Tasks added. Press Ctrl+T to open the task list and run them." Do not begin executing them unless the user explicitly says so.
 
@@ -524,7 +519,7 @@ If the user chooses D, stop after the report.
 - **Algorithm order is law.** Add-back → simplify → accelerate → automate. Never accelerate or automate before simplifying.
 - **Survivors only for steps 3–5.** Don't optimize something that should have been deleted; don't re-add scope (that's /expand).
 - **Report-first. No edits, installs, or commits until the user picks an option.**
-- **Every generated task must end with the exact line:** use kencode to reference working code. /commit when done.`,
+- **Every generated task must end with the exact line:** use steroids to reference working code. /commit when done.`,
     },
     {
         name: "bullet-proof",
@@ -675,7 +670,7 @@ After the report, ask:
 
 **Do not start fixing until the user picks.**
 
-If the user chooses A, B, or C, do not fix directly. Instead, add one task per selected finding or tightly coupled finding group using the \`tasks\` tool (action=add), ordered by severity, exploitability, and dependency. Each task needs a short title and a standalone prompt that includes the finding ID, vulnerability scenario, affected local files/anchors, concrete remediation, instructions to compare security-sensitive implementation details with kencode search or authoritative docs before editing, project verification commands, and instructions to compare the final fix with kencode search or authoritative docs again before completing the task. After adding the tasks, tell the user exactly: "${TASKS_ADDED_NOTICE}" Do not begin executing them unless the user explicitly says so.
+If the user chooses A, B, or C, do not fix directly. Instead, add one task per selected finding or tightly coupled finding group using the \`tasks\` tool (action=add), ordered by severity, exploitability, and dependency. Each task needs a short title and a standalone prompt that includes the finding ID, vulnerability scenario, affected local files/anchors, concrete remediation, instructions to compare security-sensitive implementation details with steroids or authoritative docs before editing, project verification commands, and instructions to compare the final fix with steroids or authoritative docs again before completing the task. After adding the tasks, tell the user exactly: "${TASKS_ADDED_NOTICE}" Do not begin executing them unless the user explicitly says so.
 
 ## Threat reference (May 2026)
 
@@ -841,11 +836,12 @@ description: Run checks, agent code review, commit with AI message, and push
    one-line fix. If none, reply "CLEAR". This is a last check, not a deep audit - be fast.
 
 4. If CLEAR: proceed straight to step 5 and push WITHOUT asking the user anything.
-   If issues >= 80 were reported: STOP, show the issues, and ask exactly:
-   "Want me to fix this first, or commit and push anyway?
-   A) Fix it first, then commit & push
-   B) Commit & push anyway"
-   On A: fix, re-run step 1, then continue (no re-review). On B: continue as-is.
+   If issues >= 80 were reported: STOP, show the issues, and ask with the \`ask_user\`
+   tool — one \`choice\` question (\`id: "land"\`, question "Want me to fix this first, or commit and push anyway?") with:
+   - "Fix it first, then commit & push" (recommended, hint: keeps the branch green)
+   - "Commit & push anyway" (hint: issue stays open in the log)
+   The card is the ONLY ask: show the issues, then stop — do not restate the two options as text or end with an asking line. Only if \`ask_user\` is unavailable, ask the same two options in prose.
+   On fix-first: fix, re-run step 1, then continue (no re-review). Otherwise continue as-is.
 
 5. Stage relevant files with git add (specific files, not -A)
 
@@ -870,11 +866,9 @@ Report that /commit is now available with quality checks, an agent code review g
         name: "compare",
         aliases: [],
         description: "Compare real-world code",
-        prompt: `Compare the code you just created or modified in this conversation against real-world implementations using the \`mcp__kencode-search__searchCode\` tool.
-
-${KENCODE_UNLOCK_NOTE}
+        prompt: `Compare the code you just created or modified in this conversation against real-world implementations using the \`steroids\` tool (\`search\`, then \`show\` to read the full file).
 
-You already know what you just built. For each file you created or modified, use \`mcp__kencode-search__searchCode\` to search for how real projects implement the same patterns. Look at the specific APIs, hooks, functions, and architecture you used.
+You already know what you just built. For each file you created or modified, use \`steroids\` \`search\` to find how real projects implement the same patterns. Look at the specific APIs, hooks, functions, and architecture you used.
 
 If you find something consistently done differently across real codebases, or something commonly included that you left out, report it:
 
@@ -882,12 +876,56 @@ If you find something consistently done differently across real codebases, or so
 [MISSING/DIVERGENT/INCOMPLETE] file:line - What it is
 Wrote: What was implemented
 Real-world: What real projects do instead/additionally
-Evidence: kencode-search - pattern seen in X out of Y repos searched
+Evidence: steroids — pattern seen in X of Y repos
 \`\`\`
 
-Style preferences and subjective improvements are not valid findings. Only report things backed by clear kencode-search evidence across multiple repos.
+Style preferences and subjective improvements are not valid findings. Only report things backed by clear steroids evidence across multiple repos.
 
 If the code aligns well with real-world patterns, say so. That's a good outcome.`,
+    },
+    {
+        name: "steroids",
+        aliases: [],
+        description: "Index real repos like this project",
+        prompt: `# Steroids: build a code corpus that matches THIS project
+
+Goal: fill the local \`steroids\` corpus with real, current, well-maintained repos that do what this project does, in the same stack, so later work can read proven code instead of guessing.
+
+If the \`steroids\` tool is not available, stop and tell the user to install Agent Steroids first (Home screen, Steroids button). Do not improvise with bash.
+
+## Phase 0: Profile the project
+
+Inspect the local project (manifests, top-level layout, README, main entry points) and write a short private profile:
+
+- What it is and does, and who uses it.
+- Primary language(s) and the frameworks/libraries that define it (not every dependency, the ones that shape the code).
+- Its shape: CLI, web app, desktop app, API, library, game, firmware, pipeline, etc.
+- The 3-5 hardest or most central technical topics (e.g. "Tauri sidecar lifecycle", "streaming LLM tool calls", "trigram search index").
+
+If the user passed arguments to /steroids, treat them as the focus and let them override the profile.
+
+## Phase 1: Discover candidates
+
+Call \`steroids\` \`repos\` once so you know what is already indexed. Then run 3-6 \`steroids\` \`discover\` queries WITHOUT \`add\`, each targeting a different angle from the profile: the framework (\`topic:<framework> language:<lang>\`), the product category (peer projects), and the central technical topics. Queries are GitHub repo searches, so keep each one SHORT: one \`topic:\` plus \`language:\`, or 2-3 keywords. A sentence like "llm streaming tool calls sdk" returns nothing. \`limit\` 10-15 per query. Never pass \`add\`.
+
+Merge the results, drop anything already indexed, and rank by fit with this project first, then stars and recent \`pushed_at\`. Keep at most 20.
+
+## Phase 2: Present and ask
+
+FIRST print ONE markdown table of the ranked candidates: rank, repo, stars, last push, and a one-line "why it fits" tied to the profile. The user decides from this table, so it is never optional and never summarised away. ONLY THEN ask with the \`ask_user\` tool: one \`choice\` question (\`id: "count"\`, question "How many of these should I index?") with these options, each with a one-line hint on disk/time cost:
+
+- All of them
+- Top 10
+- Top 5
+- None
+
+Mark Top 10 as recommended. Leave the free-text escape on so they can name specific ranks. The card is the ONLY ask: do not also list the options as text, and do not end with an asking line. Only if \`ask_user\` is unavailable, ask the same question in prose as a lettered list.
+
+Do not index anything until the user answers.
+
+## Phase 3: Index
+
+Tell the user indexing is starting and can take a few minutes (each repo is a full download). Then index exactly the chosen repos with \`steroids\` \`add\` (\`repos\` = owner/name list, \`tag\` = a short slug for this project, e.g. its directory name), 2-3 repos per call so progress is visible and a cancel loses little. Then confirm with \`steroids\` \`repos\` filtered by that tag and report what was added, what failed, and the new corpus size. Suggest one concrete \`steroids\` \`search\` the user could run next against the new repos.`,
     },
     {
         name: "setup-skills",

package/dist/core/prompt-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-commands.js","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAS5C,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC;AAE5B,MAAM,kBAAkB,GAAG,SAAS;IAClC,CAAC,CAAC,2EAA2E;IAC7E,CAAC,CAAC,+DAA+D,CAAC;AACpE,8EAA8E;AAC9E,wEAAwE;AACxE,0DAA0D;AAC1D,MAAM,wBAAwB,GAAG,SAAS;IACxC,CAAC,CAAC,4MAA4M;IAC9M,CAAC,CAAC,uNAAuN,CAAC;AAE5N,yCAAyC;AACzC,MAAM,aAAa,GAAG,CAAC,KAAsB,EAAU,EAAE,CACvD,+DAA+D,KAAK,8BAA8B,CAAC;AAErG;;;GAGG;AACH,MAAM,mBAAmB,GACvB,gIAAgI,CAAC;AAEnI,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,GAAG,CAAC;QACd,WAAW,EAAE,sDAAsD;QACnE,sEAAsE;QACtE,yIAAyI;QACzI,MAAM,EACJ,qJAAqJ;KACxJ;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,mCAAmC;QAChD,MAAM,EAAE;;;;;;;;;;;;;;;;;;6BAkBiB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;+NA2BkL,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0KA+BxE;KACvK;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,WAAW,EAAE,oDAAoD;QACjE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mHA8FuG;KAChH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACrB,WAAW,EAAE,oEAAoE;QACjF,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6LAqFiL;KAC1L;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mHA0GuG;KAChH;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/B,WAAW,EAAE,iFAAiF;QAC9F,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mHA0GuG;KAChH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,WAAW,EAAE,8BAA8B;QAC3C,MAAM,EAAE;;;;;;;;;;;;;;;iCAeqB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gsBAkI+oB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA4C7oB;KAClE;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,+CAA+C;QAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyCS,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCnC,wBAAwB,EAAE;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mLA0DuK;KAChL;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;EAEV,mBAAmB;;;;;;;;;;;;;;;iFAe4D;KAC9E;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAqCgC,aAAa,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gLAwDkH;KAC7K;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC"}
+{"version":3,"file":"prompt-commands.js","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAS5C,MAAM,SAAS,GAAG,OAAO,EAAE,CAAC;AAE5B,MAAM,kBAAkB,GAAG,SAAS;IAClC,CAAC,CAAC,2EAA2E;IAC7E,CAAC,CAAC,+DAA+D,CAAC;AACpE,8EAA8E;AAC9E,wEAAwE;AACxE,0DAA0D;AAC1D,MAAM,wBAAwB,GAAG,SAAS;IACxC,CAAC,CAAC,4MAA4M;IAC9M,CAAC,CAAC,uNAAuN,CAAC;AAE5N,yCAAyC;AACzC,MAAM,aAAa,GAAG,CAAC,KAAsB,EAAU,EAAE,CACvD,+DAA+D,KAAK,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,GAAG,CAAC;QACd,WAAW,EAAE,sDAAsD;QACnE,sEAAsE;QACtE,yIAAyI;QACzI,MAAM,EACJ,qJAAqJ;KACxJ;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,mCAAmC;QAChD,MAAM,EAAE;;;;;;;;;;;;;;;;;;6BAkBiB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mLA0DsI;KAChL;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,CAAC,OAAO,CAAC;QAClB,WAAW,EAAE,oDAAoD;QACjE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oHA8FwG;KACjH;IACD;QACE,IAAI,EAAE,YAAY;QAClB,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC;QACrB,WAAW,EAAE,oEAAoE;QACjF,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6LAqFiL;KAC1L;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,CAAC,QAAQ,CAAC;QACnB,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oHA0GwG;KACjH;IACD;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/B,WAAW,EAAE,iFAAiF;QAC9F,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oHA0GwG;KACjH;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,WAAW,EAAE,8BAA8B;QAC3C,MAAM,EAAE;;;;;;;;;;;;;;;iCAeqB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;orBAkImoB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA4CjoB;KAClE;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,+CAA+C;QAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qBAyCS,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCnC,wBAAwB,EAAE;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mLA2DuK;KAChL;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;iFAeqE;KAC9E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,oCAAoC;QACjD,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6hBAsCihB;KAC1hB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAqCgC,aAAa,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gLAwDkH;KAC7K;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/core/sandbox.d.ts

@@ -21,6 +21,12 @@ export interface SandboxPolicy {
     additionalRoots?: string[];
     /** The user consented to writes outside the workspace; do not contradict them. */
     allowOutsideWorkspaceWrites?: boolean;
+    /**
+     * Unix socket paths sandboxed commands may open, e.g.
+     * `/var/run/docker.sock`. Empty by default — each entry is a hole straight
+     * through the sandbox (see {@link buildSandboxSettings}).
+     */
+    allowUnixSockets?: string[];
 }
 export interface SandboxLaunch extends ShellResolution {
     sandboxed: boolean;
@@ -60,9 +66,15 @@ interface SandboxSettings {
         allowGitConfig: boolean;
     };
 }
+export interface SandboxSupport {
+    supported: boolean;
+    reason: string;
+    /** Isolation started but is missing a control we promised; null when intact. */
+    degraded?: string | null;
+}
 /** Pure policy builder, exported so the security boundary is regression-tested. */
 export declare function buildSandboxSettings(cwd: string, policy: SandboxPolicy, platform?: NodeJS.Platform): SandboxSettings;
-export declare function resetSandboxSupportProbeForTests(): void;
+export declare function resetSandboxSupportProbeForTests(seed?: SandboxSupport): void;
 /**
  * Known limitations when `sandboxMode` is enabled (upstream, not fixable here):
  *
@@ -78,6 +90,10 @@ export declare function resetSandboxSupportProbeForTests(): void;
  *   registry host configured explicitly.
  * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
  *   degrades to no isolation (sandbox-runtime#428, #429).
+ * - **Loopback egress is unfiltered**: sandboxed commands can reach any local
+ *   TCP port, because upstream ties that to port binding and dev servers need
+ *   to bind. A service listening on localhost without authentication is
+ *   reachable from sandboxed bash.
  *
  * These are why the default is `off`; revisit when fixed upstream.
  */

package/dist/core/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,KAAK,CAAC;IACnC;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kFAAkF;IAClF,2BAA2B,CAAC,EAAE,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D,CAAC;AAEF,UAAU,eAAe;IACvB,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;;;;OAQG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,8EAA8E;QAC9E,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAgED,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,eAAe,CA+DjB;AAeD,wBAAgB,gCAAgC,IAAI,IAAI,CAGvD;AAwDD;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CA4BxB"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,GAAG,WAAW,GAAG,KAAK,CAAC;IACnC;;;OAGG;IACH,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,kFAAkF;IAClF,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,aAAc,SAAQ,eAAe;IACpD,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE9D,CAAC;AAEF,UAAU,eAAe;IACvB,OAAO,EAAE;QACP,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,aAAa,EAAE,MAAM,EAAE,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC;QACzB,gBAAgB,EAAE,MAAM,EAAE,CAAC;QAC3B,iBAAiB,EAAE,OAAO,CAAC;KAC5B,CAAC;IACF;;;;;;;;OAQG;IACH,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,UAAU,EAAE;QACV,QAAQ,EAAE,MAAM,EAAE,CAAC;QACnB,UAAU,EAAE,MAAM,EAAE,CAAC;QACrB,SAAS,EAAE,MAAM,EAAE,CAAC;QACpB,8EAA8E;QAC9E,cAAc,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAkBD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAsGD,mFAAmF;AACnF,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,EACrB,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,eAAe,CAkHjB;AAeD,wBAAgB,gCAAgC,CAAC,IAAI,CAAC,EAAE,cAAc,GAAG,IAAI,CAI5E;AAiED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CA6CxB"}

package/dist/core/sandbox.js

@@ -22,6 +22,16 @@ export const SANDBOX_ENV_PATCH = {
 const SANDBOX_CONFIG_DIR = path.join(os.homedir(), ".ezcoder", "sandbox-configs");
 const PROBE_TIMEOUT_MS = 20_000;
 let warnedUnsupported = false;
+let warnedDegraded = false;
+/**
+ * Linux ships unix-socket blocking as a separate `apply-seccomp` helper, and
+ * when it is missing SRT continues with the filter silently dropped
+ * (linux-sandbox-utils.js:403 and :1118). The sandbox still starts, still
+ * reports success, and still filters the network — but a sandboxed process can
+ * open AF_UNIX sockets again, which is the Docker/SSH-agent socket back.
+ * `workspace` mode promises to fail closed, so it has to notice.
+ */
+const DEGRADED_ISOLATION = /seccomp[^\n]*not available|unix socket (?:blocking disabled|access not restricted)/i;
 function sensitiveReadPaths(home) {
     return [
         path.join(home, ".ssh"),
@@ -78,6 +88,48 @@ function withRealPath(target) {
         return [target];
     }
 }
+/** `candidate` is `zone` or sits underneath it. */
+function isInside(candidate, zone) {
+    return candidate === zone || candidate.startsWith(zone + path.sep);
+}
+/**
+ * Resolve one WRITE root, refusing to let a symlink widen our own authority.
+ *
+ * {@link withRealPath} grants write access to wherever a path resolves to. That
+ * is required for OS aliases (/tmp → /private/tmp) but is unsafe for roots the
+ * sandbox itself hands over to untrusted code: every {@link toolCacheDirs}
+ * entry is writable *by the sandboxed process*, so a command could delete one
+ * and leave a symlink behind (`rm -rf ~/.deno && ln -s / ~/.deno`). The next
+ * policy build would resolve that root to `/` and grant write access to the
+ * whole filesystem — a persistent escape that outlives the run that planted it.
+ *
+ * So a resolved root is only accepted while it stays inside a zone we already
+ * intended to expose. Anything else is an authority expansion rather than a
+ * path alias, and BOTH forms are dropped: keeping the symlink itself would
+ * still write through to the target. Losing a tool cache costs a slower
+ * install; keeping it can cost the machine.
+ */
+function safeWriteRoots(target, zones) {
+    let real;
+    try {
+        real = realpathSync(target);
+    }
+    catch {
+        // Not created yet (common for tool caches) — nothing to resolve, and a
+        // path that does not exist cannot be pointing anywhere dangerous yet.
+        return [target];
+    }
+    if (real === target)
+        return [target];
+    if (!zones.some((zone) => isInside(real, zone))) {
+        log("WARN", "sandbox", "refusing write root that resolves outside the sandbox", {
+            target,
+            real,
+        });
+        return [];
+    }
+    return [target, real];
+}
 /** Pure policy builder, exported so the security boundary is regression-tested. */
 export function buildSandboxSettings(cwd, policy, platform = process.platform) {
     const workspace = path.resolve(cwd);
@@ -88,6 +140,29 @@ export function buildSandboxSettings(cwd, policy, platform = process.platform) {
             .map((host) => host.trim())
             .filter(Boolean)),
     ].sort();
+    // Where a write root is allowed to LAND once symlinks are resolved. These are
+    // the areas we already intended to expose, so an alias inside them is just an
+    // alias; a root resolving anywhere else is an escape attempt (see
+    // safeWriteRoots). Anchors are themselves resolved so the comparison works on
+    // macOS, where the workspace and temp dir are usually reached via /var.
+    const writeZones = [
+        ...new Set([
+            temp,
+            workspace,
+            ...(policy.additionalRoots ?? []).map((root) => path.resolve(root)),
+            path.resolve(getAppPaths().agentDir),
+            // Only when the user opted in. Listing $HOME unconditionally would
+            // accept a tool cache repointed at ~/.ssh — writing authorized_keys is
+            // persistence, and this list governs WRITES, so the ~/.ssh READ denial
+            // below would not stop it.
+            ...(policy.allowOutsideWorkspaceWrites ? [home] : []),
+            ...(platform === "win32" ? [] : ["/tmp"]),
+            // NB: the macOS /private aliases need no entry of their own — each
+            // anchor above is expanded through withRealPath, so /var/folders/… and
+            // /private/var/folders/… are both already zones. Listing bare /private
+            // would be far wider than intended (it also holds /private/etc).
+        ].flatMap(withRealPath)),
+    ];
     // Mirror resolveWriteGuard's roots. The sandbox must never be stricter than
     // the write guard the user already controls, or bash silently loses
     // multi-root workspaces and the documented outside-workspace opt-out.
@@ -101,17 +176,43 @@ export function buildSandboxSettings(cwd, policy, platform = process.platform) {
             path.resolve(getAppPaths().agentDir),
             ...toolCacheDirs(home),
             ...(policy.allowOutsideWorkspaceWrites ? [home] : []),
-        ].flatMap(withRealPath)),
+        ].flatMap((target) => safeWriteRoots(target, writeZones))),
     ];
     return {
         network: {
             allowedDomains,
             deniedDomains: [],
             strictAllowlist: true,
-            allowUnixSockets: [],
-            // Dev servers, preview servers and the screenshot tool all bind a local
-            // port. Loopback never leaves the machine, so blocking it costs core
-            // workflows without buying containment.
+            // Opt-in, and empty by default. Every entry is a full bypass of the
+            // isolation around it: `/var/run/docker.sock` is unauthenticated
+            // root-equivalent control of the host (mount / into a container and the
+            // workspace boundary is gone), and the SSH agent socket signs anything
+            // asked of it. The domain allowlist cannot see either — no TCP is
+            // involved. Users who need `docker` in sandboxed bash grant it here
+            // explicitly, rather than the sandbox quietly deciding for them.
+            //
+            // macOS only: on Linux/WSL2 SRT's seccomp filter blocks AF_UNIX by
+            // syscall and cannot inspect paths, so a per-path list is unenforceable
+            // there (it would need allowAllUnixSockets, which we do not expose).
+            allowUnixSockets: platform === "darwin" ? [...new Set(policy.allowUnixSockets ?? [])] : [],
+            // Always on, with no setting to turn it off.
+            //
+            // SRT couples three rules into this flag: network-bind, network-inbound
+            // and `(allow network-outbound (remote ip "localhost:*"))`
+            // (macos-sandbox-utils.js:473-477), with no per-port form. Dev servers,
+            // preview servers and the screenshot tool all bind loopback, so turning
+            // it off breaks everyday work outright.
+            //
+            // The egress half is a real hole only for someone running an
+            // unauthenticated service on a local TCP port — `docker` exposed on
+            // tcp://localhost:2375, a bare Ollama, a live `kubectl proxy`. That is
+            // rare and self-inflicted, and the common case is already covered: Docker
+            // listens on /var/run/docker.sock by default, which allowUnixSockets
+            // above keeps shut. A setting for the remainder would be one more knob
+            // nobody turns, breaking dev servers for whoever found it by accident.
+            //
+            // Linux is unaffected regardless: bwrap gives the sandbox its own network
+            // namespace, so its loopback is not the host's.
             allowLocalBinding: true,
         },
         ...(platform === "darwin" ? { enableWeakerNetworkIsolation: true } : {}),
@@ -149,9 +250,10 @@ function resolveSandboxCli() {
  * reimplementing its per-platform dependency matrix.
  */
 let supportProbe = null;
-export function resetSandboxSupportProbeForTests() {
-    supportProbe = null;
+export function resetSandboxSupportProbeForTests(seed) {
+    supportProbe = seed ? Promise.resolve(seed) : null;
     warnedUnsupported = false;
+    warnedDegraded = false;
 }
 function probeSandboxSupport(settingsPath) {
     supportProbe ??= new Promise((resolve) => {
@@ -159,6 +261,11 @@ function probeSandboxSupport(settingsPath) {
         try {
             child = spawn(process.execPath, [resolveSandboxCli(), "--settings", settingsPath, "-c", "exit 0"], {
                 stdio: ["ignore", "ignore", "pipe"],
+                // SRT reports the dropped seccomp filter through its debug logger, so
+                // the one probe run has to ask for it. Only on Linux, which is the
+                // only platform that degrades this way, and the output is parsed and
+                // discarded here rather than shown.
+                ...(process.platform === "linux" ? { env: { ...process.env, SRT_DEBUG: "1" } } : {}),
             });
         }
         catch (error) {
@@ -166,12 +273,17 @@ function probeSandboxSupport(settingsPath) {
             return;
         }
         let stderr = "";
+        let degraded = null;
         child.stderr?.on("data", (chunk) => {
-            stderr = `${stderr}${chunk.toString("utf8")}`.slice(-500);
+            const text = chunk.toString("utf8");
+            // Match per chunk: `stderr` keeps only the tail for the failure message,
+            // and under SRT_DEBUG the warning is easily scrolled past it.
+            degraded ??= text.match(DEGRADED_ISOLATION)?.[0] ?? null;
+            stderr = `${stderr}${text}`.slice(-500);
         });
         const timer = setTimeout(() => {
             child.kill("SIGKILL");
-            resolve({ supported: false, reason: "sandbox probe timed out" });
+            resolve({ supported: false, reason: "sandbox probe timed out", degraded });
         }, PROBE_TIMEOUT_MS);
         timer.unref?.();
         child.once("error", (error) => {
@@ -183,6 +295,7 @@ function probeSandboxSupport(settingsPath) {
             resolve({
                 supported: code === 0,
                 reason: code === 0 ? "ok" : stderr.trim() || `sandbox probe exited with code ${code}`,
+                degraded,
             });
         });
     });
@@ -217,6 +330,10 @@ async function writeStableSettings(settings) {
  *   registry host configured explicitly.
  * - **Ubuntu 24.04+**: AppArmor blocks the sandbox entirely, so `auto`
  *   degrades to no isolation (sandbox-runtime#428, #429).
+ * - **Loopback egress is unfiltered**: sandboxed commands can reach any local
+ *   TCP port, because upstream ties that to port binding and dev servers need
+ *   to bind. A service listening on localhost without authentication is
+ *   reachable from sandboxed bash.
  *
  * These are why the default is `off`; revisit when fixed upstream.
  */
@@ -244,6 +361,20 @@ export async function prepareSandboxLaunch(shell, cwd, policy) {
         }
         return { ...shell, sandboxed: false };
     }
+    if (support.degraded) {
+        if (policy.mode === "workspace") {
+            throw new Error(`OS sandbox isolation is incomplete: ${support.degraded}. Unix sockets ` +
+                `(Docker, the SSH agent) stay reachable from sandboxed commands. Install ` +
+                `@anthropic-ai/sandbox-runtime globally so the apply-seccomp helper is on ` +
+                `disk, or set sandboxMode to "auto" to accept reduced isolation.`);
+        }
+        if (!warnedDegraded) {
+            warnedDegraded = true;
+            log("WARN", "sandbox", "OS sandbox running with reduced isolation", {
+                reason: support.degraded,
+            });
+        }
+    }
     return {
         file: process.execPath,
         args: [resolveSandboxCli(), "--settings", settingsPath, "--", shell.file, ...shell.args],

package/dist/core/sandbox.js.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AA+B/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,gBAAgB,EAAE,EAAE;CACrB,CAAC;AA6BF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAE9B,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAqB,EACrB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;aACjF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB;KACF,CAAC,IAAI,EAAE,CAAC;IACT,4EAA4E;IAC5E,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CACR;YACE,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI;YACJ,oEAAoE;YACpE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpC,GAAG,aAAa,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,OAAO,CAAC,YAAY,CAAC,CACxB;KACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,aAAa,EAAE,EAAE;YACjB,eAAe,EAAE,IAAI;YACrB,gBAAgB,EAAE,EAAE;YACpB,wEAAwE;YACxE,qEAAqE;YACrE,wCAAwC;YACxC,iBAAiB,EAAE,IAAI;SACxB;QACD,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,qEAAqE;YACrE,kDAAkD;YAClD,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,WAAW,CAAC;YAC5E,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,sDAAsD;YACtD,EAAE;YACF,qEAAqE;YACrE,iCAAiC;YACjC,cAAc,EAAE,IAAI;YACpB,2EAA2E;YAC3E,2EAA2E;YAC3E,0BAA0B;YAC1B,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;aAC9B,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAA2D,IAAI,CAAC;AAEhF,MAAM,UAAU,gCAAgC;IAC9C,YAAY,GAAG,IAAI,CAAC;IACpB,iBAAiB,GAAG,KAAK,CAAC;AAC5B,CAAC;AAED,SAAS,mBAAmB,CAC1B,YAAoB;IAEpB,YAAY,KAAK,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CACX,OAAO,CAAC,QAAQ,EAChB,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,EACjE;gBACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;aACpC,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,GAAG,GAAG,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACnE,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,SAAS,EAAE,IAAI,KAAK,CAAC;gBACrB,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,IAAI,EAAE;aACtF,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAyB;IAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,GAAW,EACX,MAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,yCAAyC;gBACxD,qEAAqE;gBACrE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,iDAAiD,EAAE;gBACxE,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,IAAI,EAAE,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;QACxF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../src/core/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAqC/D;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAqC;IACjE,gBAAgB,EAAE,EAAE;CACrB,CAAC;AA6BF,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC;AAClF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,IAAI,iBAAiB,GAAG,KAAK,CAAC;AAC9B,IAAI,cAAc,GAAG,KAAK,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,kBAAkB,GACtB,qFAAqF,CAAC;AASxF,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,WAAW,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC;KAClD,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,SAAS,QAAQ,CAAC,SAAiB,EAAE,IAAY;IAC/C,OAAO,SAAS,KAAK,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,KAAwB;IAC9D,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,sEAAsE;QACtE,OAAO,CAAC,MAAM,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,uDAAuD,EAAE;YAC9E,MAAM;YACN,IAAI;SACL,CAAC,CAAC;QACH,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,oBAAoB,CAClC,GAAW,EACX,MAAqB,EACrB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,cAAc,GAAG;QACrB,GAAG,IAAI,GAAG,CACR,CAAC,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,EAAE,GAAG,MAAM,CAAC,cAAc,CAAC;aACjF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CACnB;KACF,CAAC,IAAI,EAAE,CAAC;IACT,8EAA8E;IAC9E,8EAA8E;IAC9E,kEAAkE;IAClE,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CACR;YACE,IAAI;YACJ,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpC,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,2BAA2B;YAC3B,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,mEAAmE;YACnE,uEAAuE;YACvE,uEAAuE;YACvE,iEAAiE;SAClE,CAAC,OAAO,CAAC,YAAY,CAAC,CACxB;KACF,CAAC;IACF,4EAA4E;IAC5E,oEAAoE;IACpE,sEAAsE;IACtE,MAAM,UAAU,GAAG;QACjB,GAAG,IAAI,GAAG,CACR;YACE,SAAS;YACT,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI;YACJ,oEAAoE;YACpE,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC;YACpC,GAAG,aAAa,CAAC,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAC1D;KACF,CAAC;IAEF,OAAO;QACL,OAAO,EAAE;YACP,cAAc;YACd,aAAa,EAAE,EAAE;YACjB,eAAe,EAAE,IAAI;YACrB,oEAAoE;YACpE,iEAAiE;YACjE,wEAAwE;YACxE,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,EAAE;YACF,mEAAmE;YACnE,wEAAwE;YACxE,qEAAqE;YACrE,gBAAgB,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;YAC1F,6CAA6C;YAC7C,EAAE;YACF,wEAAwE;YACxE,2DAA2D;YAC3D,wEAAwE;YACxE,wEAAwE;YACxE,wCAAwC;YACxC,EAAE;YACF,6DAA6D;YAC7D,oEAAoE;YACpE,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,uEAAuE;YACvE,uEAAuE;YACvE,EAAE;YACF,0EAA0E;YAC1E,gDAAgD;YAChD,iBAAiB,EAAE,IAAI;SACxB;QACD,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,UAAU,EAAE;YACV,QAAQ,EAAE,kBAAkB,CAAC,IAAI,CAAC;YAClC,qEAAqE;YACrE,kDAAkD;YAClD,UAAU,EAAE,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,WAAW,CAAC;YAC5E,wEAAwE;YACxE,yEAAyE;YACzE,qEAAqE;YACrE,sDAAsD;YACtD,EAAE;YACF,qEAAqE;YACrE,iCAAiC;YACjC,cAAc,EAAE,IAAI;YACpB,2EAA2E;YAC3E,2EAA2E;YAC3E,0BAA0B;YAC1B,SAAS,EAAE,YAAY,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;aAC9B,CAAC;SACH;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;;;GAKG;AACH,IAAI,YAAY,GAAmC,IAAI,CAAC;AAExD,MAAM,UAAU,gCAAgC,CAAC,IAAqB;IACpE,YAAY,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,iBAAiB,GAAG,KAAK,CAAC;IAC1B,cAAc,GAAG,KAAK,CAAC;AACzB,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAoB;IAC/C,YAAY,KAAK,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QACvC,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CACX,OAAO,CAAC,QAAQ,EAChB,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,CAAC,EACjE;gBACE,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC;gBACnC,sEAAsE;gBACtE,mEAAmE;gBACnE,qEAAqE;gBACrE,oCAAoC;gBACpC,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAG,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;YAChE,OAAO;QACT,CAAC;QACD,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,QAAQ,GAAkB,IAAI,CAAC;QACnC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACzC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,yEAAyE;YACzE,8DAA8D;YAC9D,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,GAAG,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,CAAC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7E,CAAC,EAAE,gBAAgB,CAAC,CAAC;QACrB,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YAC1B,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC;gBACN,SAAS,EAAE,IAAI,KAAK,CAAC;gBACrB,MAAM,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,kCAAkC,IAAI,EAAE;gBACrF,QAAQ;aACT,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAyB;IAC1D,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;IACtD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,MAAM,OAAO,CAAC,CAAC;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAAsB,EACtB,GAAW,EACX,MAAqB;IAErB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACjE,MAAM,YAAY,GAAG,MAAM,mBAAmB,CAAC,oBAAoB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;IAElF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,yCAAyC;gBACxD,qEAAqE;gBACrE,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,iBAAiB,GAAG,IAAI,CAAC;YACzB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,iDAAiD,EAAE;gBACxE,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrB,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CACb,uCAAuC,OAAO,CAAC,QAAQ,iBAAiB;gBACtE,0EAA0E;gBAC1E,2EAA2E;gBAC3E,iEAAiE,CACpE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,cAAc,GAAG,IAAI,CAAC;YACtB,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,2CAA2C,EAAE;gBAClE,MAAM,EAAE,OAAO,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,QAAQ;QACtB,IAAI,EAAE,CAAC,iBAAiB,EAAE,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC;QACxF,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,SAAS,EAAE,IAAI;KAChB,CAAC;AACJ,CAAC"}

package/dist/core/session-manager.d.ts

@@ -1,5 +1,5 @@
 import { type Message, type Provider, type Usage } from "@prestyj/ai";
-import type { AgentTurnTiming } from "@prestyj/agent";
+import { type AgentTurnTiming } from "@prestyj/agent";
 import type { CompletedItem } from "../ui/app-items.js";
 import { type StorageNormalizationMetrics } from "./session-storage.js";
 interface BaseEntry {
@@ -259,6 +259,8 @@ export declare class SessionManager {
     private static maintenanceByRoot;
     private sessionsDir;
     private warnedPersistCodes;
+    /** Session files whose tail this process already checked (see {@link sealTornTail}). */
+    private sealedTails;
     /** Called once per error code when session persistence fails (e.g. ENOSPC). */
     onPersistError?: (error: NodeJS.ErrnoException) => void;
     constructor(sessionsDir: string);
@@ -271,6 +273,21 @@ export declare class SessionManager {
     withCompactionLease<T>(conversationId: string, signal: AbortSignal | undefined, work: () => Promise<T>): Promise<T>;
     readCompactionAttemptState(conversationId: string): Promise<CompactionAttemptState | null>;
     writeCompactionAttemptState(conversationId: string, state: CompactionAttemptState): Promise<void>;
+    /**
+     * Terminate a half-written last line before appending after it.
+     *
+     * Entries are one JSON object per line, appended with a trailing newline. A
+     * process killed mid-append leaves that final line without its newline — and
+     * the next append then fuses onto it, so ONE torn write destroys TWO records:
+     * the incomplete one and the first record of the resumed turn. Both are then
+     * silently skipped as malformed at load, so the user loses a message from
+     * their own history with no error shown. Writing the missing newline first
+     * confines the loss to the record that was actually torn.
+     *
+     * Once per file per process: the fuse can only happen on the first append
+     * after opening a file that someone else left torn.
+     */
+    private sealTornTail;
     /**
      * Session persistence must never crash a live session. Disk-full (ENOSPC),
      * permission, or quota errors during transcript writes are reported once