@proletariat/cli 0.3.48 → 0.3.49

package/dist/commands/work/revise.js

@@ -76,7 +76,7 @@ export default class WorkRevise extends PMOCommand {
         // Early Docker check
         if (!flags['run-on-host'] && !isDockerRunning()) {
             return handleError('DOCKER_NOT_RUNNING', 'Docker is not running.\n\n' +
-                'Docker is required for devcontainer execution (recommended for agent sandboxing).\n' +
+                'Docker is required for devcontainer execution (recommended for agent isolation).\n' +
                 'Please start Docker Desktop and try again.\n\n' +
                 'Alternatively, use --run-on-host to run directly on your machine (bypasses sandbox).');
         }
@@ -220,7 +220,7 @@ export default class WorkRevise extends PMOCommand {
             const hasDevcontainer = hasDevcontainerConfig(agentDir);
             let environment = 'host';
             let displayMode = 'terminal';
-            let sandboxed = false;
+            let permissionMode = 'danger';
             const reviseJsonModeConfig = jsonMode ? { flags: flags, commandName: 'work revise' } : null;
             if (hasDevcontainer && !flags['run-on-host']) {
                 environment = 'devcontainer';
@@ -245,19 +245,19 @@ export default class WorkRevise extends PMOCommand {
             const executor = flags.executor || DEFAULT_EXECUTION_CONFIG.defaultExecutor;
             const executorName = getExecutorDisplayName(executor);
             // Permission mode
-            const { permissionMode } = await this.prompt([
+            const { permissionMode: selectedPermMode } = await this.prompt([
                 {
                     type: 'list',
                     name: 'permissionMode',
                     message: `Permission mode for ${executorName}:`,
                     choices: [
-                        { name: 'danger - Skip permission checks (faster for revisions)', value: 'danger', command: `prlt work revise ${ticketId} --json` },
-                        { name: 'safe   - Requires approval for dangerous operations', value: 'safe', command: `prlt work revise ${ticketId} --json` },
+                        { name: '⚠️  danger - Skip permission checks (faster for revisions)', value: 'danger', command: `prlt work revise ${ticketId} --json` },
+                        { name: '🔒 safe   - Requires approval for dangerous operations', value: 'safe', command: `prlt work revise ${ticketId} --json` },
                     ],
                     default: 'danger',
                 },
             ], reviseJsonModeConfig);
-            sandboxed = permissionMode === 'safe';
+            permissionMode = selectedPermMode;
             // Show execution info
             this.log('');
             this.log(styles.header(`Revising: ${ticket.id}: ${ticket.title}`));
@@ -292,7 +292,7 @@ export default class WorkRevise extends PMOCommand {
                 executor,
                 environment,
                 displayMode,
-                sandboxed,
+                permissionMode,
                 branch,
             });
             this.log(styles.muted(`   Work ID: ${execution.id}`));
@@ -327,7 +327,7 @@ export default class WorkRevise extends PMOCommand {
                 executionConfig.shell = shell;
             }
             executionConfig.outputMode = 'interactive';
-            executionConfig.sandboxed = sandboxed;
+            executionConfig.permissionMode = permissionMode;
             // Run execution
             this.log(styles.muted('Starting agent to address feedback...'));
             const sessionManager = (flags.session || 'tmux');

package/dist/commands/work/spawn.js

@@ -1198,7 +1198,7 @@ export default class WorkSpawn extends PMOCommand {
                 }
                 // Prompt for environment (devcontainer vs host) if devcontainer available and not already set
                 if (hasDevcontainer && !batchRunOnHost && !batchDisplay) {
-                    const devcontainerLabel = '🐳 devcontainer (sandboxed, recommended)';
+                    const devcontainerLabel = '🐳 devcontainer (isolated, recommended)';
                     const envChoices = [
                         { name: devcontainerLabel, value: 'devcontainer' },
                         { name: '💻 host (runs directly on your machine)', value: 'host' },

package/dist/commands/work/start.js

@@ -805,10 +805,10 @@ export default class WorkStart extends PMOCommand {
             // Determine execution environment and display mode
             let environment = 'host';
             let displayMode = 'terminal';
-            let sandboxed = false; // Whether --dangerously-skip-permissions is NOT used
+            let permissionMode = 'danger';
             if (hasDevcontainer && !flags.display && !flags['run-on-host']) {
                 // Agent has devcontainer - prompt for environment choice
-                const devcontainerLabel = '🐳 devcontainer (sandboxed, recommended)';
+                const devcontainerLabel = '🐳 devcontainer (isolated, recommended)';
                 const envChoices = [
                     { name: devcontainerLabel, value: 'devcontainer' },
                     { name: '💻 host (runs directly on your machine)', value: 'host' },
@@ -1211,11 +1211,11 @@ export default class WorkStart extends PMOCommand {
             const actionModifiesCode = context.modifiesCode !== false;
             const defaultPermissionMode = actionModifiesCode ? 'danger' : 'safe';
             if (flags['permission-mode']) {
-                sandboxed = flags['permission-mode'] === 'safe';
+                permissionMode = (flags['permission-mode'] || 'danger');
             }
             else if (!actionModifiesCode) {
                 // Non-code-modifying actions automatically use safe mode
-                sandboxed = true;
+                permissionMode = 'safe';
             }
             else {
                 const containerNote = environment === 'devcontainer'
@@ -1241,7 +1241,7 @@ export default class WorkStart extends PMOCommand {
                     when: (ctx) => !ctx.flags['permission-mode'],
                 });
                 const resolvedPermission = await permissionResolver.resolve();
-                sandboxed = resolvedPermission['permission-mode'] === 'safe';
+                permissionMode = (resolvedPermission['permission-mode'] || 'danger');
             }
             // Prompt for PR creation when work is complete
             // Resolution order: explicit flags > workspace config default > interactive prompt
@@ -1312,7 +1312,7 @@ export default class WorkStart extends PMOCommand {
                 this.log(styles.muted(`   Environment: ${envIcon} ${environment}`));
                 this.log(styles.muted(`   Display: ${displayMode}`));
                 // Permissions info
-                if (sandboxed) {
+                if (permissionMode === 'safe') {
                     this.log(styles.success(`   Permissions: 🔒 safe`));
                 }
                 else {
@@ -1529,7 +1529,7 @@ export default class WorkStart extends PMOCommand {
                 executor,
                 environment,
                 displayMode,
-                sandboxed,
+                permissionMode,
                 branch,
             });
             if (!jsonMode) {
@@ -1569,8 +1569,8 @@ export default class WorkStart extends PMOCommand {
             }
             // Set output mode from user selection
             executionConfig.outputMode = outputMode;
-            // Set sandboxed mode (determines whether --dangerously-skip-permissions is used)
-            executionConfig.sandboxed = sandboxed;
+            // Set permission mode (determines whether --dangerously-skip-permissions is used)
+            executionConfig.permissionMode = permissionMode;
             // Handle --focus flag: when set, bring terminal to foreground instead of opening in background
             if (flags.focus) {
                 executionConfig.terminal.openInBackground = false;
@@ -1992,7 +1992,7 @@ export default class WorkStart extends PMOCommand {
         const environment = useDevcontainer ? 'devcontainer' : 'host';
         const displayMode = 'terminal';
         const actionModifiesCode = context.modifiesCode !== false;
-        const sandboxed = flags['permission-mode'] === 'safe' || (!flags['permission-mode'] && !actionModifiesCode);
+        const permissionMode = flags['permission-mode'] || (!actionModifiesCode ? 'safe' : 'danger');
         const executor = flags.executor || DEFAULT_EXECUTION_CONFIG.defaultExecutor;
         const outputMode = 'interactive';
         // Handle git branch - only if action modifies code
@@ -2033,14 +2033,14 @@ export default class WorkStart extends PMOCommand {
             executor,
             environment,
             displayMode,
-            sandboxed,
+            permissionMode,
             branch,
         });
         // Note: Ticket status update moved to after successful spawn
         // Load execution config
         const executionConfig = loadExecutionConfig(db);
         executionConfig.outputMode = outputMode;
-        executionConfig.sandboxed = sandboxed;
+        executionConfig.permissionMode = permissionMode;
         // Run execution
         this.log(styles.muted(`   Starting ${ticket.id} → ${agentName}...`));
         const batchSessionManager = (flags.session || 'tmux');

package/dist/commands/work/watch.js

@@ -161,7 +161,7 @@ export default class WorkWatch extends PMOCommand {
             if (!flags.mode) {
                 if (hasDevcontainer) {
                     const envChoices = [
-                        { name: '🐳 devcontainer (sandboxed, recommended)', value: 'devcontainer' },
+                        { name: '🐳 devcontainer (isolated, recommended)', value: 'devcontainer' },
                         { name: '💻 host (runs directly on your machine)', value: 'host' },
                     ];
                     if (jsonMode) {
@@ -244,13 +244,13 @@ export default class WorkWatch extends PMOCommand {
             const promptResult = await promptExecutionSettings(db, {
                 displayMode: this.displayMode,
                 environment: this.environment,
-                skipPermissions: flags['skip-permissions'] ? true : undefined,
+                permissionMode: flags['skip-permissions'] ? 'danger' : undefined,
                 createPR: flags['create-pr'] ? true : undefined,
                 log: (msg) => this.log(styles.header(msg)),
                 jsonMode: jsonMode ? { flags, commandName: 'work watch' } : undefined,
             });
             this.executionConfig = promptResult.executionConfig;
-            this.skipPermissions = promptResult.skipPermissions;
+            this.skipPermissions = promptResult.permissionMode === 'danger';
             this.createPR = promptResult.createPR;
             this.log('');
             this.log(styles.header(`👁️  Watching column "${this.columnName}" for new tickets`));

package/dist/lib/agents/index.js

@@ -223,7 +223,7 @@ export async function createAgentWorktrees(workspacePath, agents, hqPath, option
                             }
                         }
                     }
-                    // Create devcontainer config for sandboxed execution
+                    // Create devcontainer config for isolated execution
                     // Note: Agent metadata is stored in SQLite (agents table), not in config files
                     // Always create devcontainer config (even if no repos were created) so agent rebuild works
                     if (!options?.skipDevcontainer) {
@@ -368,7 +368,7 @@ export async function createAgentWorktrees(workspacePath, agents, hqPath, option
                         }
                     }
                 }
-                // Create devcontainer config for sandboxed execution
+                // Create devcontainer config for isolated execution
                 // Note: Agent metadata is stored in SQLite (agents table), not in config files
                 if (!options?.skipDevcontainer) {
                     console.log(styles.muted(`  Creating devcontainer config...`));

package/dist/lib/database/drizzle-schema.d.ts

@@ -3548,19 +3548,19 @@ export declare const pmoAgentWork: import("drizzle-orm/sqlite-core").SQLiteTable
             identity: undefined;
             generated: undefined;
         }, object>;
-        sandboxed: import("drizzle-orm/sqlite-core").SQLiteColumn<{
-            name: "sandboxed";
+        permissionMode: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "permission_mode";
             tableName: "agent_work";
-            dataType: "boolean";
-            columnType: "SQLiteBoolean";
-            data: boolean;
-            driverParam: number;
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
             notNull: true;
             hasDefault: true;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: undefined;
+            enumValues: [string, ...string[]];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/lib/database/drizzle-schema.js

@@ -428,7 +428,7 @@ export const pmoAgentWork = sqliteTable('agent_work', {
     executor: text('executor').notNull(),
     environment: text('environment').notNull().default('host'),
     displayMode: text('display_mode').notNull().default('terminal'),
-    sandboxed: integer('sandboxed', { mode: 'boolean' }).notNull().default(false),
+    permissionMode: text('permission_mode').notNull().default('safe'),
     status: text('status').notNull().default('starting'),
     branch: text('branch'),
     pid: text('pid'),

package/dist/lib/execution/config.d.ts

@@ -5,7 +5,7 @@
  * Uses the workspace_settings table (not pmo_settings - execution is workspace-level).
  */
 import Database from 'better-sqlite3';
-import { ExecutionConfig, TerminalApp, Shell, DisplayMode, OutputMode, ExecutionEnvironment, AuthMethod } from './types.js';
+import { ExecutionConfig, TerminalApp, Shell, DisplayMode, OutputMode, ExecutionEnvironment, AuthMethod, PermissionMode } from './types.js';
 import { type JsonFlags } from '../prompt-json.js';
 declare const CONFIG_KEYS: {
     terminalApp: string;
@@ -15,7 +15,7 @@ declare const CONFIG_KEYS: {
     defaultExecutor: string;
     autoExecute: string;
     outputMode: string;
-    sandboxed: string;
+    permissionMode: string;
     tmuxSession: string;
     tmuxLayout: string;
     tmuxControlMode: string;
@@ -130,8 +130,8 @@ export interface ExecutionPromptOptions {
     environment: ExecutionEnvironment;
     /** Skip output mode prompt and use this value instead */
     outputMode?: OutputMode;
-    /** Skip permission prompt and use this value instead */
-    skipPermissions?: boolean;
+    /** Permission mode override (skips prompt) */
+    permissionMode?: PermissionMode;
     /** Skip PR prompt and use this value instead */
     createPR?: boolean;
     /** Force re-prompt for terminal preferences */
@@ -147,8 +147,8 @@ export interface ExecutionPromptOptions {
 export interface ExecutionPromptResult {
     /** Execution config with terminal/shell/output settings */
     executionConfig: ExecutionConfig;
-    /** Whether to skip permission checks */
-    skipPermissions: boolean;
+    /** Permission mode for agent execution */
+    permissionMode: PermissionMode;
     /** Whether to create PR when work is ready */
     createPR: boolean;
 }

package/dist/lib/execution/config.js

@@ -19,7 +19,7 @@ const CONFIG_KEYS = {
     defaultExecutor: 'execution.default_executor',
     autoExecute: 'execution.auto_execute',
     outputMode: 'execution.output_mode',
-    sandboxed: 'execution.sandboxed',
+    permissionMode: 'execution.permission_mode',
     tmuxSession: 'execution.tmux.session',
     tmuxLayout: 'execution.tmux.layout',
     tmuxControlMode: 'execution.tmux.control_mode',
@@ -95,10 +95,17 @@ export function loadExecutionConfig(db) {
     if (outputMode) {
         config.outputMode = outputMode;
     }
-    // Load sandboxed preference
-    const sandboxed = getSetting(db, CONFIG_KEYS.sandboxed);
-    if (sandboxed !== null) {
-        config.sandboxed = sandboxed === 'true';
+    // Load permission mode preference
+    const permissionMode = getSetting(db, CONFIG_KEYS.permissionMode);
+    if (permissionMode) {
+        config.permissionMode = permissionMode;
+    }
+    else {
+        // Backward compat: read legacy 'execution.sandboxed' setting
+        const legacySandboxed = getSetting(db, 'execution.sandboxed');
+        if (legacySandboxed !== null) {
+            config.permissionMode = legacySandboxed === 'true' ? 'safe' : 'danger';
+        }
     }
     // Load auth method preference
     const authMethod = getSetting(db, CONFIG_KEYS.authMethod);
@@ -491,8 +498,8 @@ export async function promptExecutionSettings(db, options) {
     }
     executionConfig.outputMode = outputMode;
     // Prompt for permissions mode (unless flag override is provided)
-    let skipPermissions = options.skipPermissions ?? false;
-    if (options.skipPermissions === undefined) {
+    let resolvedPermissionMode = options.permissionMode ?? 'safe';
+    if (options.permissionMode === undefined) {
         const containerNote = (environment === 'devcontainer' || environment === 'docker')
             ? ' (container provides additional isolation)'
             : '';
@@ -504,7 +511,7 @@ export async function promptExecutionSettings(db, options) {
         if (isJsonMode && jsonMode) {
             outputPromptAsJson(buildPromptConfig('list', 'permissionMode', `Permission mode for Claude Code${containerNote}:`, permissionChoices, 'safe'), createMetadata(jsonMode.commandName, jsonMode.flags));
         }
-        const { permissionMode } = await inquirer.prompt([
+        const { permissionMode: selectedMode } = await inquirer.prompt([
             {
                 type: 'list',
                 name: 'permissionMode',
@@ -513,7 +520,7 @@ export async function promptExecutionSettings(db, options) {
                 default: 'safe',
             },
         ]);
-        skipPermissions = permissionMode === 'danger';
+        resolvedPermissionMode = selectedMode;
     }
     // Prompt for PR creation when work is complete (unless flag override is provided)
     let createPR = options.createPR ?? false;
@@ -542,7 +549,7 @@ export async function promptExecutionSettings(db, options) {
     }
     return {
         executionConfig,
-        skipPermissions,
+        permissionMode: resolvedPermissionMode,
         createPR,
     };
 }

package/dist/lib/execution/devcontainer.d.ts

@@ -1,8 +1,8 @@
 /**
  * Devcontainer Template Generator
  *
- * Generates .devcontainer/ configuration for agent sandboxed execution.
- * Uses a custom Dockerfile with network firewall for security sandboxing.
+ * Generates .devcontainer/ configuration for agent isolated execution.
+ * Uses a custom Dockerfile with network firewall for security isolation.
  */
 import { ExecutionConfig, ExecutorType } from './types.js';
 export type MountMode = 'worktree' | 'clone';
@@ -48,7 +48,7 @@ export interface DevcontainerJson {
 /**
  * Generate default devcontainer.json content
  *
- * Uses a custom Dockerfile with firewall for network sandboxing.
+ * Uses a custom Dockerfile with firewall for network isolation.
  * Mounts the entire agent workspace directory so all contents (repos, prompt files, etc.)
  * are accessible inside the container at /workspace.
  */

package/dist/lib/execution/devcontainer.js

@@ -1,8 +1,8 @@
 /**
  * Devcontainer Template Generator
  *
- * Generates .devcontainer/ configuration for agent sandboxed execution.
- * Uses a custom Dockerfile with network firewall for security sandboxing.
+ * Generates .devcontainer/ configuration for agent isolated execution.
+ * Uses a custom Dockerfile with network firewall for security isolation.
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -11,7 +11,7 @@ import { parseChannel } from '../workspace-config.js';
 /**
  * Generate default devcontainer.json content
  *
- * Uses a custom Dockerfile with firewall for network sandboxing.
+ * Uses a custom Dockerfile with firewall for network isolation.
  * Mounts the entire agent workspace directory so all contents (repos, prompt files, etc.)
  * are accessible inside the container at /workspace.
  */

package/dist/lib/execution/runners.d.ts

@@ -3,7 +3,7 @@
  *
  * Implementations for each execution environment (devcontainer, host, docker, vm).
  */
-import { ExecutionEnvironment, DisplayMode, OutputMode, SessionManager, ExecutorType, ExecutionContext, ExecutionConfig } from './types.js';
+import { ExecutionEnvironment, DisplayMode, OutputMode, PermissionMode, SessionManager, ExecutorType, ExecutionContext, ExecutionConfig } from './types.js';
 /**
  * Build a unified name for tmux sessions, window names, and tab titles.
  * Format: "{ticketId}-{action}-{agentName}"
@@ -162,7 +162,7 @@ export declare function getContainerId(containerName: string): string | null;
  * Uses docker exec for direct container access.
  * Uses a prompt file to avoid shell escaping issues.
  */
-export declare function buildDevcontainerCommand(context: ExecutionContext, executor: ExecutorType, promptFile: string, containerId?: string, outputMode?: OutputMode, sandboxed?: boolean, displayMode?: DisplayMode): string;
+export declare function buildDevcontainerCommand(context: ExecutionContext, executor: ExecutorType, promptFile: string, containerId?: string, outputMode?: OutputMode, permissionMode?: PermissionMode, displayMode?: DisplayMode): string;
 /**
  * Run command inside a Docker container.
  * Uses raw Docker commands for filesystem isolation - no devcontainer CLI required.

package/dist/lib/execution/runners.js

@@ -386,11 +386,11 @@ export async function runHost(context, executor, config, displayMode = 'terminal
     const sessionName = buildTmuxWindowName(context);
     const windowTitle = buildWindowTitle(context);
     const prompt = buildPrompt(context);
-    // Terminal - use sandboxed setting
-    const skipPermissions = !config.sandboxed;
+    // Terminal - use permission mode setting
+    const skipPermissions = config.permissionMode === 'danger';
     // Validate Codex mode combination before proceeding
     if (executor === 'codex') {
-        const codexPermission = config.sandboxed ? 'safe' : 'danger';
+        const codexPermission = config.permissionMode;
         const codexContext = resolveCodexExecutionContext(displayMode, config.outputMode);
         const modeError = validateCodexMode(codexPermission, codexContext);
         if (modeError) {
@@ -934,7 +934,7 @@ function createDockerContainer(context, containerName, imageName, config, execut
         `--memory=${config.devcontainer.memory}`,
         `--cpus=${config.devcontainer.cpus}`,
     ];
-    // Security flags - these provide the sandboxing
+    // Security flags - these provide the isolation
     const securityFlags = [
         '--cap-add=NET_ADMIN', // For firewall setup
         '--cap-add=NET_RAW', // For firewall setup
@@ -966,10 +966,10 @@ function createDockerContainer(context, containerName, imageName, config, execut
  * Run the post-start setup commands in a container.
  * This includes firewall initialization, prlt setup, and Claude settings.
  * @param containerId - Docker container ID
- * @param sandboxed - Whether running in safe mode (true) or danger mode (false)
+ * @param permissionMode - Permission mode: 'safe' requires approval, 'danger' skips checks
  * @param executor - Which executor is being used (determines Claude-specific setup)
  */
-function runContainerSetup(containerId, sandboxed = true, executor = 'claude-code') {
+function runContainerSetup(containerId, permissionMode = 'safe', executor = 'claude-code') {
     try {
         // Run firewall init (requires sudo since we're running as node user)
         execSync(`docker exec ${containerId} sudo /usr/local/bin/init-firewall.sh`, { stdio: 'pipe' });
@@ -1010,9 +1010,9 @@ function runContainerSetup(containerId, sandboxed = true, executor = 'claude-cod
                     console.debug('[runners:docker] Failed to parse host .claude.json, using empty settings');
                 }
             }
-            // Only set bypassPermissionsModeAccepted when user chose danger mode (!sandboxed)
+            // Only set bypassPermissionsModeAccepted when user chose danger mode
             // This doesn't modify the host file - only the container copy
-            if (!sandboxed) {
+            if (permissionMode === 'danger') {
                 settings.bypassPermissionsModeAccepted = true;
             }
             // Skip first-run onboarding (theme picker, tips, etc.) for automated agents
@@ -1047,7 +1047,7 @@ function runContainerSetup(containerId, sandboxed = true, executor = 'claude-cod
             const settingsJson = JSON.stringify(settings);
             // Write to container at /home/node/.claude.json using stdin piping
             execSync(`docker exec -i ${containerId} bash -c 'cat > /home/node/.claude.json'`, { input: settingsJson, stdio: ['pipe', 'pipe', 'pipe'] });
-            console.debug(`[runners:docker] Copied .claude.json settings to container (bypassPermissionsModeAccepted=${!sandboxed})`);
+            console.debug(`[runners:docker] Copied .claude.json settings to container (bypassPermissionsModeAccepted=${permissionMode === 'danger'})`);
             // Write ~/.claude/settings.json to skip the dangerous mode permission prompt (TKT-1134)
             // This prevents Claude Code from prompting about permission mode on first run
             const claudeSettings = JSON.stringify({ skipDangerousModePermissionPrompt: true });
@@ -1153,10 +1153,10 @@ function ensureDockerContainer(context, config, executor = 'claude-code') {
         return null;
     }
     // Run post-start setup (firewall, prlt, Claude settings)
-    // Pass sandboxed config to determine whether to set bypassPermissionsModeAccepted
+    // Pass permission mode to determine whether to set bypassPermissionsModeAccepted
     // Pass executor to skip Claude-specific setup for non-Claude executors
-    console.debug(`[runners:docker] Running container setup (sandboxed=${config.sandboxed}, executor=${executor})`);
-    if (!runContainerSetup(containerId, config.sandboxed, executor)) {
+    console.debug(`[runners:docker] Running container setup (permissionMode=${config.permissionMode}, executor=${executor})`);
+    if (!runContainerSetup(containerId, config.permissionMode, executor)) {
         console.debug(`[runners:docker] Setup failed, but continuing...`);
         // Don't fail completely - setup might partially work
     }
@@ -1240,23 +1240,22 @@ function writePromptFile(context) {
  * Uses docker exec for direct container access.
  * Uses a prompt file to avoid shell escaping issues.
  */
-export function buildDevcontainerCommand(context, executor, promptFile, containerId, outputMode = 'interactive', sandboxed = true, displayMode = 'terminal') {
+export function buildDevcontainerCommand(context, executor, promptFile, containerId, outputMode = 'interactive', permissionMode = 'safe', displayMode = 'terminal') {
     // Calculate the relative path from agentDir to worktreePath for cd
     const relativePath = path.relative(context.agentDir, context.worktreePath);
     const cdCmd = relativePath ? `cd /workspace/${relativePath} && ` : '';
     // Build executor command using the centralized getExecutorCommand()
     // This ensures all runners use consistent executor invocation
     let executorCmd;
+    const skipPermissions = permissionMode === 'danger';
     if (isClaudeExecutor(executor)) {
-        // Claude-specific flags based on output mode and sandboxed setting
+        // Claude-specific flags based on output mode and permission mode
         // - interactive: No -p flag, shows streaming UI (watch Claude work in real-time)
         // - print: Uses -p flag, outputs final result only (better for logs/automation)
         const printFlag = outputMode === 'print' ? '-p ' : '';
-        // sandboxed=true means safe mode (no --dangerously-skip-permissions)
-        // sandboxed=false means danger mode (use --dangerously-skip-permissions)
         // --permission-mode bypassPermissions: skips the "trust this folder" dialog
         const bypassTrustFlag = '--permission-mode bypassPermissions ';
-        const permissionsFlag = !sandboxed ? '--dangerously-skip-permissions ' : '';
+        const permissionsFlag = skipPermissions ? '--dangerously-skip-permissions ' : '';
         // --effort high: skips the effort level prompt for automated agents (TKT-1134)
         const effortFlag = '--effort high ';
         executorCmd = `claude ${bypassTrustFlag}${permissionsFlag}${effortFlag}${printFlag}"$(cat ${promptFile})"`;
@@ -1264,7 +1263,7 @@ export function buildDevcontainerCommand(context, executor, promptFile, containe
     else if (executor === 'codex') {
         // Use Codex adapter for mode validation and deterministic command building.
         // Validates that the permission/display combination is supported before building.
-        const codexPermission = sandboxed ? 'safe' : 'danger';
+        const codexPermission = permissionMode;
         const codexContext = resolveCodexExecutionContext(displayMode, outputMode);
         const modeError = validateCodexMode(codexPermission, codexContext);
         if (modeError) {
@@ -1276,7 +1275,7 @@ export function buildDevcontainerCommand(context, executor, promptFile, containe
     }
     else {
         // Non-Claude, non-Codex executors: use getExecutorCommand() to get correct command and args
-        const { cmd, args } = getExecutorCommand(executor, `PLACEHOLDER`, !sandboxed);
+        const { cmd, args } = getExecutorCommand(executor, `PLACEHOLDER`, skipPermissions);
         // Replace the placeholder prompt with a file read for shell safety
         const argsStr = args.map(a => a === 'PLACEHOLDER' ? `"$(cat ${promptFile})"` : a).join(' ');
         executorCmd = `${cmd} ${argsStr}`;
@@ -1365,7 +1364,7 @@ export async function runDevcontainer(context, executor, config, displayMode = '
         }
         // Build the docker exec command (just runs claude directly)
         // tmux session setup is handled by runDevcontainerInTmux, not buildDevcontainerCommand
-        const devcontainerCmd = buildDevcontainerCommand(context, executor, promptFile, containerId, config.outputMode, config.sandboxed, displayMode);
+        const devcontainerCmd = buildDevcontainerCommand(context, executor, promptFile, containerId, config.outputMode, config.permissionMode, displayMode);
         // Execute based on display mode
         // When sessionManager is 'tmux', always use tmux inside container for session persistence
         // (allows reattach via `prlt session attach` even for background mode)
@@ -2017,7 +2016,7 @@ export async function runDocker(context, executor, config) {
         }
         // Validate Codex mode: Docker runner is always non-tty (detached with -d)
         if (executor === 'codex') {
-            const codexPermission = config.sandboxed ? 'safe' : 'danger';
+            const codexPermission = config.permissionMode;
             const modeError = validateCodexMode(codexPermission, 'non-tty');
             if (modeError) {
                 return { success: false, error: modeError.message };
@@ -2025,7 +2024,7 @@ export async function runDocker(context, executor, config) {
         }
         // Build executor command using getExecutorCommand() for correct invocation
         const escapedPrompt = prompt.replace(/'/g, "'\\''");
-        const { cmd, args } = getExecutorCommand(executor, escapedPrompt, !config.sandboxed);
+        const { cmd, args } = getExecutorCommand(executor, escapedPrompt, config.permissionMode === 'danger');
         // For Claude Code in Docker, use --print for non-interactive output
         // Non-Claude executors use their native command format from getExecutorCommand()
         dockerCmd += ` ${config.docker.image}`;
@@ -2087,7 +2086,7 @@ export async function runVm(context, executor, config, host) {
         }
         // Validate Codex mode: VM runner is always non-tty (SSH + nohup)
         if (executor === 'codex') {
-            const codexPermission = config.sandboxed ? 'safe' : 'danger';
+            const codexPermission = config.permissionMode;
             const modeError = validateCodexMode(codexPermission, 'non-tty');
             if (modeError) {
                 return { success: false, error: modeError.message };
@@ -2095,7 +2094,7 @@ export async function runVm(context, executor, config, host) {
         }
         // Execute on remote using executor-appropriate command
         const escapedPrompt = prompt.replace(/'/g, "'\\''");
-        const { cmd: executorCmd, args: executorArgs } = getExecutorCommand(executor, escapedPrompt, !config.sandboxed);
+        const { cmd: executorCmd, args: executorArgs } = getExecutorCommand(executor, escapedPrompt, config.permissionMode === 'danger');
         // Build the remote command based on executor type
         let remoteCmd;
         if (isClaudeExecutor(executor)) {

package/dist/lib/execution/spawner.js

@@ -282,7 +282,7 @@ export async function spawnAgentForTicket(ticket, agentName, storage, executionS
         environment = 'host';
     }
     const displayMode = options.displayMode || 'terminal';
-    const sandboxed = !(options.skipPermissions ?? false);
+    const permissionMode = (options.skipPermissions ?? false) ? 'danger' : 'safe';
     // Executor preflight check (TKT-1082): verify binary is available before proceeding
     // For host environment, check immediately. For devcontainer, check happens after container start.
     if (environment === 'host') {
@@ -457,12 +457,12 @@ export async function spawnAgentForTicket(ticket, agentName, storage, executionS
         executor,
         environment,
         displayMode,
-        sandboxed,
+        permissionMode,
         branch,
     });
     // Load execution config (use passed config or load from db)
     const executionConfig = options.executionConfig || loadExecutionConfig(db);
-    executionConfig.sandboxed = sandboxed;
+    executionConfig.permissionMode = permissionMode;
     // Run execution
     // Default to tmux for session persistence (enables peek/poke/attach)
     const sessionManager = options.sessionManager || 'tmux';

package/dist/lib/execution/storage.d.ts

@@ -4,7 +4,7 @@
  * Database operations for agent_work table.
  */
 import Database from 'better-sqlite3';
-import { AgentWork, ExecutionStatus, ExecutorType, ExecutionEnvironment, DisplayMode } from './types.js';
+import { AgentWork, ExecutionStatus, ExecutorType, ExecutionEnvironment, DisplayMode, PermissionMode } from './types.js';
 export declare class ExecutionStorage {
     private db;
     constructor(db: Database.Database);
@@ -18,7 +18,7 @@ export declare class ExecutionStorage {
         executor: ExecutorType;
         environment: ExecutionEnvironment;
         displayMode: DisplayMode;
-        sandboxed: boolean;
+        permissionMode: PermissionMode;
         branch?: string;
         pid?: string;
         containerId?: string;