@qduc/term2 0.8.0 → 0.9.1

package/dist/utils/shell/sandbox/denied-read-stores.js

@@ -0,0 +1,166 @@
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * In-memory, session-scoped store of denied-read info keyed by normalized command string.
+ *
+ * Lifecycle of an entry:
+ * 1. `execute` detects a denied read → `record(command, info)`.
+ * 2. The agent retries the same command; the approval-result builder calls `consume(command)` → returns the info
+ *    (so the approval gate fires), then `stageForDescriptor(command, info)` re-stages it so the
+ *    approval-result builder can attach `deniedRead` metadata to the ApprovalDescriptor.
+ * 3. `consumeStaged(command)` is called by the approval flow to set the retry override and clear.
+ */
+export class DeniedReadStore {
+    #byCommand = new Map();
+    #stagedByDescriptorKey = new Map();
+    record(command, info) {
+        this.#byCommand.set(command, info);
+    }
+    consume(command) {
+        const info = this.#byCommand.get(command);
+        if (info) {
+            this.#byCommand.delete(command);
+            return info;
+        }
+        return null;
+    }
+    peek(command) {
+        return this.#byCommand.get(command) ?? null;
+    }
+    has(command) {
+        return this.#byCommand.has(command);
+    }
+    stageForDescriptor(descriptorKey, info) {
+        this.#stagedByDescriptorKey.set(descriptorKey, info);
+    }
+    consumeStaged(descriptorKey) {
+        const info = this.#stagedByDescriptorKey.get(descriptorKey);
+        if (info) {
+            this.#stagedByDescriptorKey.delete(descriptorKey);
+            return info;
+        }
+        return null;
+    }
+    clear() {
+        this.#byCommand.clear();
+        this.#stagedByDescriptorKey.clear();
+    }
+}
+/**
+ * In-memory, per-command store of execution overrides. Set at approval-decision time;
+ * consumed and cleared by `execute` when the SDK resumes the approved tool call.
+ */
+export class ExecutionOverrideStore {
+    #byCommand = new Map();
+    set(command, override) {
+        this.#byCommand.set(command, override);
+    }
+    consume(command) {
+        const override = this.#byCommand.get(command);
+        if (override) {
+            this.#byCommand.delete(command);
+            return override;
+        }
+        return null;
+    }
+    clear() {
+        this.#byCommand.clear();
+    }
+}
+const PROJECT_CONFIG_DIR = '.term2';
+const PROJECT_CONFIG_FILE = 'sandbox-allow-paths.json';
+/**
+ * Persistent, project-scoped store of remembered allow-read paths.
+ * Stored at `<workspaceRoot>/.term2/sandbox-allow-paths.json`.
+ *
+ * Paths are realpath-normalized and deduplicated before persistence.
+ * A separate, dedicated store (not the global settings system) so that remembered
+ * paths stay scoped to the workspace where they were approved.
+ */
+export class ProjectSandboxAllowReadStore {
+    #workspaceRoot;
+    #log;
+    #fs;
+    constructor(workspaceRoot, fsImpl, log) {
+        this.#workspaceRoot = workspaceRoot;
+        this.#fs = fsImpl ?? fs;
+        this.#log = log;
+    }
+    get #configPath() {
+        return path.join(this.#workspaceRoot, PROJECT_CONFIG_DIR, PROJECT_CONFIG_FILE);
+    }
+    load() {
+        try {
+            if (!this.#fs.existsSync(this.#configPath))
+                return [];
+            const raw = this.#fs.readFileSync(this.#configPath, 'utf8');
+            const parsed = JSON.parse(raw);
+            if (!parsed || !Array.isArray(parsed.allowReadExtra))
+                return [];
+            return this.#normalize(parsed.allowReadExtra);
+        }
+        catch (error) {
+            // Corrupt or unreadable config: fail safe with an empty list.
+            this.#log?.warn('Failed to read project sandbox-allow-paths; returning empty list', {
+                error: error instanceof Error ? error.message : String(error),
+            });
+            return [];
+        }
+    }
+    append(filePath) {
+        const normalized = this.#normalizeOne(filePath);
+        const current = this.load();
+        if (current.includes(normalized))
+            return;
+        const next = [...current, normalized];
+        this.#write(next);
+    }
+    #write(paths) {
+        const dir = path.dirname(this.#configPath);
+        this.#fs.mkdirSync(dir, { recursive: true });
+        const payload = { version: 1, allowReadExtra: paths };
+        this.#fs.writeFileSync(this.#configPath, JSON.stringify(payload, null, 2) + '\n', 'utf8');
+    }
+    #normalize(paths) {
+        return Array.from(new Set(paths.map((p) => this.#normalizeOne(p))));
+    }
+    #normalizeOne(filePath) {
+        try {
+            return this.#fs.realpathSync(filePath);
+        }
+        catch {
+            return path.resolve(filePath);
+        }
+    }
+}
+/**
+ * Module-level singletons shared between the shell tool and the approval flow.
+ * A conversation is single-threaded in this CLI, so entries are consumed in order.
+ * Each entry is one-shot (consumed on use), so no cross-turn contamination occurs.
+ */
+export const deniedReadStore = new DeniedReadStore();
+export const executionOverrideStore = new ExecutionOverrideStore();
+let projectAllowReadStore = null;
+let projectAllowReadStoreRoot = null;
+/**
+ * Returns the project-scoped allow-read store for the given workspace root.
+ * The store is lazily created and re-created if the workspace root changes
+ * (unlikely in practice — the launch cwd is stable for the process).
+ */
+export function getProjectAllowReadStore(workspaceRoot) {
+    if (!projectAllowReadStore || projectAllowReadStoreRoot !== workspaceRoot) {
+        projectAllowReadStore = new ProjectSandboxAllowReadStore(workspaceRoot);
+        projectAllowReadStoreRoot = workspaceRoot;
+    }
+    return projectAllowReadStore;
+}
+/**
+ * Test-only: reset all module-level singletons. Not for production use.
+ */
+export function resetSandboxDeniedReadStoresForTest() {
+    deniedReadStore.clear();
+    executionOverrideStore.clear();
+    projectAllowReadStore = null;
+    projectAllowReadStoreRoot = null;
+}
+//# sourceMappingURL=denied-read-stores.js.map

package/dist/utils/shell/sandbox/denied-read-stores.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"denied-read-stores.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/denied-read-stores.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAc7B;;;;;;;;;GASG;AACH,MAAM,OAAO,eAAe;IAC1B,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,sBAAsB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE3D,MAAM,CAAC,OAAe,EAAE,IAAoB;QAC1C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACrC,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAe;QAClB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAED,GAAG,CAAC,OAAe;QACjB,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAED,kBAAkB,CAAC,aAAqB,EAAE,IAAoB;QAC5D,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,aAAqB;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC5D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,CAAC;IACtC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,sBAAsB;IACjC,UAAU,GAAG,IAAI,GAAG,EAA6B,CAAC;IAElD,GAAG,CAAC,OAAe,EAAE,QAA2B;QAC9C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,OAAO,CAAC,OAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAChC,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC;AACpC,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAOvD;;;;;;;GAOG;AACH,MAAM,OAAO,4BAA4B;IAC9B,cAAc,CAAS;IACvB,IAAI,CAAmB;IACvB,GAAG,CAAY;IAExB,YAAY,aAAqB,EAAE,MAAkB,EAAE,GAAqB;QAC1E,IAAI,CAAC,cAAc,GAAG,aAAa,CAAC;QACpC,IAAI,CAAC,GAAG,GAAG,MAAM,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,mBAAmB,CAAC,CAAC;IACjF,CAAC;IAED,IAAI;QACF,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC;gBAAE,OAAO,EAAE,CAAC;YACtD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAmC,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,8DAA8D;YAC9D,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,kEAAkE,EAAE;gBAClF,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,OAAO;QACzC,MAAM,IAAI,GAAG,CAAC,GAAG,OAAO,EAAE,UAAU,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,KAAe;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7C,MAAM,OAAO,GAA0B,EAAE,OAAO,EAAE,CAAC,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5F,CAAC;IAED,UAAU,CAAC,KAAe;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IAED,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC;AACrD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAEnE,IAAI,qBAAqB,GAAwC,IAAI,CAAC;AACtE,IAAI,yBAAyB,GAAkB,IAAI,CAAC;AAEpD;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,aAAqB;IAC5D,IAAI,CAAC,qBAAqB,IAAI,yBAAyB,KAAK,aAAa,EAAE,CAAC;QAC1E,qBAAqB,GAAG,IAAI,4BAA4B,CAAC,aAAa,CAAC,CAAC;QACxE,yBAAyB,GAAG,aAAa,CAAC;IAC5C,CAAC;IACD,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC;IACjD,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,sBAAsB,CAAC,KAAK,EAAE,CAAC;IAC/B,qBAAqB,GAAG,IAAI,CAAC;IAC7B,yBAAyB,GAAG,IAAI,CAAC;AACnC,CAAC"}

package/dist/utils/shell/sandbox/sandbox-env.d.ts

@@ -0,0 +1,7 @@
+export declare function isSecretKey(key: string): boolean;
+export interface SandboxEnvironmentOptions {
+    cwd?: string;
+    readPolicy?: 'standard' | 'strict';
+}
+export declare function createSandboxEnvironment(source?: NodeJS.ProcessEnv, options?: SandboxEnvironmentOptions): NodeJS.ProcessEnv;
+//# sourceMappingURL=sandbox-env.d.ts.map

package/dist/utils/shell/sandbox/sandbox-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-env.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-env.ts"],"names":[],"mappings":"AAQA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAehD;AAED,MAAM,WAAW,yBAAyB;IACxC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,UAAU,GAAG,QAAQ,CAAC;CACpC;AAED,wBAAgB,wBAAwB,CACtC,MAAM,GAAE,MAAM,CAAC,UAAwB,EACvC,OAAO,GAAE,yBAA8B,GACtC,MAAM,CAAC,UAAU,CAsBnB"}

package/dist/utils/shell/sandbox/sandbox-env.js

@@ -0,0 +1,40 @@
+import { resolveSandboxXdgLayout } from '../temp-dir.js';
+const ALLOWED_EXACT_KEYS = new Set(['PATH', 'SHELL', 'TMPDIR', 'TEMP', 'TMP', 'TERM', 'HOME']);
+function isAllowedKey(key) {
+    return ALLOWED_EXACT_KEYS.has(key) || key === 'LANG' || key.startsWith('LC_');
+}
+export function isSecretKey(key) {
+    return (/(^|_)API_KEY$/.test(key) ||
+        /(^|_)TOKEN$/.test(key) ||
+        /(^|_)SECRET$/.test(key) ||
+        key.startsWith('AWS_') ||
+        key.startsWith('GOOGLE_') ||
+        key.startsWith('GCP_') ||
+        key.startsWith('AZURE_') ||
+        key.startsWith('OPENAI_') ||
+        key.startsWith('ANTHROPIC_') ||
+        key === 'GITHUB_TOKEN' ||
+        key === 'SSH_AUTH_SOCK' ||
+        key === 'SSH_AGENT_PID');
+}
+export function createSandboxEnvironment(source = process.env, options = {}) {
+    const env = {};
+    for (const [key, value] of Object.entries(source)) {
+        // Layer-1a backstop: redundant while the allowlist stays tiny; do not remove.
+        // It is the last line of defense inside Layer 1 if a secret-shaped key is ever allowlisted.
+        if (value === undefined || isSecretKey(key) || !isAllowedKey(key)) {
+            continue;
+        }
+        env[key] = value;
+    }
+    if (options.readPolicy === 'strict') {
+        const cwd = options.cwd ?? process.cwd();
+        const { config, cache, data, state } = resolveSandboxXdgLayout(cwd);
+        env.XDG_CONFIG_HOME = config;
+        env.XDG_CACHE_HOME = cache;
+        env.XDG_DATA_HOME = data;
+        env.XDG_STATE_HOME = state;
+    }
+    return env;
+}
+//# sourceMappingURL=sandbox-env.js.map

package/dist/utils/shell/sandbox/sandbox-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-env.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAE/F,SAAS,YAAY,CAAC,GAAW;IAC/B,OAAO,kBAAkB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,CACL,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC;QACzB,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QACvB,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QACxB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACtB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC;QACtB,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC;QACxB,GAAG,CAAC,UAAU,CAAC,SAAS,CAAC;QACzB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC;QAC5B,GAAG,KAAK,cAAc;QACtB,GAAG,KAAK,eAAe;QACvB,GAAG,KAAK,eAAe,CACxB,CAAC;AACJ,CAAC;AAOD,MAAM,UAAU,wBAAwB,CACtC,SAA4B,OAAO,CAAC,GAAG,EACvC,UAAqC,EAAE;IAEvC,MAAM,GAAG,GAAsB,EAAE,CAAC;IAElC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,8EAA8E;QAC9E,4FAA4F;QAC5F,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAClE,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,IAAI,OAAO,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,uBAAuB,CAAC,GAAG,CAAC,CAAC;QACpE,GAAG,CAAC,eAAe,GAAG,MAAM,CAAC;QAC7B,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;QAC3B,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC;QACzB,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC;IAC7B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.d.ts

@@ -0,0 +1,41 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+export type SandboxReadPolicy = 'standard' | 'strict';
+export type ShellSandboxMode = 'default' | 'unsandboxed';
+export type SandboxAvailability = {
+    type: 'available';
+} | {
+    type: 'disabled';
+} | {
+    type: 'unsupported_platform';
+    reason: string;
+} | {
+    type: 'missing_dependency';
+    reason: string;
+} | {
+    type: 'initialization_failed';
+    reason: string;
+};
+export interface ShellSandboxRunner {
+    availability(): Promise<SandboxAvailability>;
+    wrap(command: string, options: {
+        cwd: string;
+        config?: SandboxRuntimeConfig;
+        signal?: AbortSignal;
+    }): Promise<{
+        command: string;
+        diagnostics?: string[];
+    }>;
+    cleanupAfterCommand?(): void | Promise<void>;
+    annotateFailure(command: string, stderr: string): string;
+}
+export interface CreateSandboxRuntimeConfigOptions {
+    readPolicy?: SandboxReadPolicy;
+    allowReadExtra?: string[];
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    onProtectedFiltered?: (filtered: readonly string[]) => void;
+}
+export declare function isPathProtected(target: string, home: string): boolean;
+export declare function createSandboxRuntimeConfig(options?: CreateSandboxRuntimeConfigOptions): SandboxRuntimeConfig;
+export declare const SANDBOX_ESCAPE_INSTRUCTION = "Sandbox blocked this command. To request a one-shot escape, call shell again with sandbox=\"unsandboxed\"; user approval will be required.";
+//# sourceMappingURL=sandbox-policy.d.ts.map

package/dist/utils/shell/sandbox/sandbox-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAI1E,MAAM,MAAM,iBAAiB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEtD,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,CAAC;AAEzD,MAAM,MAAM,mBAAmB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,GACpB;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,IAAI,EAAE,uBAAuB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,CACF,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACxD,mBAAmB,CAAC,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC;CAC1D;AAED,MAAM,WAAW,iCAAiC;IAChD,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,mBAAmB,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,KAAK,IAAI,CAAC;CAC7D;AAoFD,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA0BrE;AAED,wBAAgB,0BAA0B,CAAC,OAAO,GAAE,iCAAsC,GAAG,oBAAoB,CA6GhH;AAED,eAAO,MAAM,0BAA0B,+IACqG,CAAC"}

package/dist/utils/shell/sandbox/sandbox-policy.js

@@ -0,0 +1,217 @@
+import os from 'node:os';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
+import { isSecretKey } from './sandbox-env.js';
+// Paths the sandbox must never allow writing to, regardless of where term2
+// was launched from. Two classes:
+//   - EXACT: only when cwd (resolved) is exactly the path
+//   - SUBTREE: when cwd (resolved) is the path or any descendant
+// Both Linux and macOS paths are listed; the runtime drops non-existent paths
+// per platform. This list is hardcoded on purpose: it is the floor of what
+// "do not destroy the user's system" means, and giving users a setting to
+// weaken it would defeat the point. See docs/sandbox-filesystem-read-hardening.md.
+const EXACT_PROTECTED_WRITE_PATHS = [
+    '$HOME', // resolved via os.homedir() at use time
+    '/root',
+    '/var',
+    '/private/var',
+    '/mnt',
+    '/media',
+    '/srv',
+    '/opt',
+];
+const SUBTREE_PROTECTED_WRITE_PATHS = [
+    '/etc',
+    '/private/etc',
+    '/boot',
+    '/usr',
+    '/bin',
+    '/sbin',
+    '/lib',
+    '/lib64',
+    '/proc',
+    '/sys',
+    '/dev',
+    '/Library',
+    '/System',
+    '/System/Library',
+];
+// Common dev locations are intentionally NOT protected:
+//   /usr/local, /opt/homebrew, /tmp, /private/tmp
+// These host Homebrew, local builds, temp worktrees, and cache dirs.
+// Blocking them would break normal development workflows.
+//
+// Writable carve-outs that sit *inside* a SUBTREE-protected path. Without
+// this, the `/usr` subtree guard below would remove `/usr/local` (and
+// descendants like `/usr/local/src`) from allowWrite, contradicting the
+// documented exception above. Checked before subtree protection.
+const WRITABLE_SUBTREE_EXCEPTIONS = ['/usr/local'];
+function expandHomePath(filePath, home) {
+    if (filePath === '~') {
+        return home;
+    }
+    if (filePath.startsWith('~/')) {
+        return path.join(home, filePath.slice(2));
+    }
+    return filePath;
+}
+function resolveCurrentRuntimeRoot(home) {
+    try {
+        const realExecPath = fs.realpathSync(process.execPath);
+        if (!realExecPath.startsWith(`${home}${path.sep}`)) {
+            return undefined;
+        }
+        return path.dirname(path.dirname(realExecPath));
+    }
+    catch {
+        return undefined;
+    }
+}
+// Normalize $HOME the same way workspaceRoot is (realpathSync) so the exact
+// home guard still fires when os.homedir() is a symlink path and the launch
+// cwd is $HOME: workspaceRoot becomes the real path while a bare
+// path.resolve(home) would stay the symlink path. Best-effort: fall back to
+// path.resolve when the home directory cannot be resolved.
+function resolveHomePath(home) {
+    try {
+        return fs.realpathSync(home);
+    }
+    catch {
+        return path.resolve(home);
+    }
+}
+export function isPathProtected(target, home) {
+    const resolved = path.resolve(target);
+    const resolvedHome = resolveHomePath(home);
+    for (const protectedPath of EXACT_PROTECTED_WRITE_PATHS) {
+        if (resolved === path.resolve(protectedPath === '$HOME' ? resolvedHome : protectedPath)) {
+            return true;
+        }
+    }
+    // Writable carve-outs inside a subtree-protected path take precedence over
+    // subtree protection so documented exceptions (e.g. /usr/local) stay writable.
+    for (const exceptionPath of WRITABLE_SUBTREE_EXCEPTIONS) {
+        const resolvedException = path.resolve(exceptionPath);
+        if (resolved === resolvedException || resolved.startsWith(resolvedException + path.sep)) {
+            return false;
+        }
+    }
+    for (const protectedPath of SUBTREE_PROTECTED_WRITE_PATHS) {
+        const resolvedProtected = path.resolve(protectedPath);
+        if (resolved === resolvedProtected)
+            return true;
+        if (resolved.startsWith(resolvedProtected + path.sep))
+            return true;
+    }
+    return false;
+}
+export function createSandboxRuntimeConfig(options = {}) {
+    const home = os.homedir();
+    const readPolicy = options.readPolicy ?? 'standard';
+    const workspaceRoot = fs.realpathSync(options.cwd ?? process.cwd());
+    const tmpDir = SANDBOX_TEMP_DIR;
+    const appCacheDir = path.join(home, '.cache', 'term2-nodejs');
+    const rtkConfigDir = path.join(home, '.config', 'rtk');
+    const rtkDataDir = path.join(home, '.local', 'share', 'rtk');
+    const safeHomeReadPaths = [
+        path.join(home, '.gitconfig'),
+        path.join(home, '.config', 'git'),
+        path.join(home, '.npm'),
+        path.join(home, 'Library', 'pnpm'),
+        path.join(home, '.local', 'share', 'pnpm'),
+        path.join(home, '.pnpm-store'),
+        resolveCurrentRuntimeRoot(home),
+    ].filter((filePath) => Boolean(filePath));
+    const credentialFiles = [
+        path.join(home, '.ssh'),
+        path.join(home, '.aws'),
+        path.join(home, '.azure'),
+        path.join(home, '.config', 'gcloud'),
+        path.join(home, '.docker'),
+        path.join(home, '.netrc'),
+        path.join(home, '.git-credentials'),
+        path.join(home, '.bash_history'),
+        path.join(home, '.zsh_history'),
+        path.join(home, '.npmrc'),
+        path.join(home, '.pypirc'),
+        path.join(home, '.kube'),
+        path.join(home, '.gnupg'),
+        path.join(home, '.config', 'gh'),
+        path.join(home, '.gem'),
+        path.join(home, '.gemrc'),
+        path.join(home, '.config', 'hub'),
+        path.join(home, '.docker', 'config.json'),
+    ];
+    const defaultCredentialEnvVars = [
+        'AWS_ACCESS_KEY_ID',
+        'AWS_SECRET_ACCESS_KEY',
+        'AWS_SESSION_TOKEN',
+        'GOOGLE_APPLICATION_CREDENTIALS',
+        'GITHUB_TOKEN',
+        'OPENAI_API_KEY',
+        'ANTHROPIC_API_KEY',
+        'SSH_AUTH_SOCK',
+        'SSH_AGENT_PID',
+    ];
+    // Env protection layering (see docs/sandbox-filesystem-read-hardening.md §5):
+    // Layer 1 (authoritative): createSandboxEnvironment() in sandbox-env.ts drops every env
+    //   key not on a tiny allowlist of known-safe values (PATH, SHELL, TMPDIR, locale, …).
+    //   Secrets never reach the child because they are not allowlisted, not because we named them.
+    // Layer 2 (defense-in-depth): credentials.envVars below unsets the same keys at the sandbox
+    //   runtime level (bwrap --unsetenv / Seatbelt -u). It is intentionally small and
+    //   auto-populated from the live env via isSecretKey so it stays exhaustive without hardcoding.
+    //   It earns its keep only if Layer 1 ever regresses; do not treat it as the primary gate.
+    const presentSecretEnvVars = Object.keys(options.env ?? process.env).filter(isSecretKey);
+    const credentialEnvVars = Array.from(new Set([...defaultCredentialEnvVars, ...presentSecretEnvVars]));
+    const allowReadExtra = (options.allowReadExtra ?? []).map((filePath) => expandHomePath(filePath, home));
+    const denyRead = readPolicy === 'strict' ? [home, '/etc', '/var', '/root', '/private/var'] : credentialFiles;
+    const allowRead = readPolicy === 'strict'
+        ? [
+            workspaceRoot,
+            tmpDir,
+            appCacheDir,
+            rtkConfigDir,
+            rtkDataDir,
+            ...safeHomeReadPaths,
+            ...allowReadExtra,
+            '/usr',
+            '/bin',
+            '/sbin',
+            '/lib',
+            '/lib64',
+            '/opt',
+            '/Library',
+            '/System/Library',
+            '/usr/local',
+            '/opt/homebrew',
+        ]
+        : undefined;
+    const rawAllowWrite = [workspaceRoot, tmpDir];
+    const protectedFiltered = rawAllowWrite.filter((p) => isPathProtected(p, home));
+    const allowWrite = rawAllowWrite.filter((p) => !isPathProtected(p, home));
+    if (protectedFiltered.length > 0) {
+        options.onProtectedFiltered?.(protectedFiltered);
+    }
+    return {
+        network: {
+            allowedDomains: [],
+            deniedDomains: ['*'],
+            strictAllowlist: true,
+            allowLocalBinding: false,
+        },
+        filesystem: {
+            denyRead,
+            ...(allowRead ? { allowRead } : {}),
+            allowWrite,
+            denyWrite: [],
+            allowGitConfig: true,
+        },
+        credentials: {
+            files: credentialFiles.map((filePath) => ({ path: filePath, mode: 'deny' })),
+            envVars: credentialEnvVars.map((name) => ({ name, mode: 'deny' })),
+        },
+    };
+}
+export const SANDBOX_ESCAPE_INSTRUCTION = 'Sandbox blocked this command. To request a one-shot escape, call shell again with sandbox="unsandboxed"; user approval will be required.';
+//# sourceMappingURL=sandbox-policy.js.map

package/dist/utils/shell/sandbox/sandbox-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-policy.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/sandbox-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAmC/C,2EAA2E;AAC3E,kCAAkC;AAClC,0DAA0D;AAC1D,iEAAiE;AACjE,8EAA8E;AAC9E,2EAA2E;AAC3E,0EAA0E;AAC1E,mFAAmF;AACnF,MAAM,2BAA2B,GAAG;IAClC,OAAO,EAAE,wCAAwC;IACjD,OAAO;IACP,MAAM;IACN,cAAc;IACd,MAAM;IACN,QAAQ;IACR,MAAM;IACN,MAAM;CACE,CAAC;AAEX,MAAM,6BAA6B,GAAG;IACpC,MAAM;IACN,cAAc;IACd,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;IACT,iBAAiB;CACT,CAAC;AAEX,wDAAwD;AACxD,kDAAkD;AAClD,qEAAqE;AACrE,0DAA0D;AAC1D,EAAE;AACF,0EAA0E;AAC1E,sEAAsE;AACtE,wEAAwE;AACxE,iEAAiE;AACjE,MAAM,2BAA2B,GAAG,CAAC,YAAY,CAAU,CAAC;AAE5D,SAAS,cAAc,CAAC,QAAgB,EAAE,IAAY;IACpD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACnD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,4EAA4E;AAC5E,iEAAiE;AACjE,4EAA4E;AAC5E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAc,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,YAAY,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IAE3C,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,IAAI,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC;YACxF,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,+EAA+E;IAC/E,KAAK,MAAM,aAAa,IAAI,2BAA2B,EAAE,CAAC;QACxD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACxF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,aAAa,IAAI,6BAA6B,EAAE,CAAC;QAC1D,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,QAAQ,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;IACrE,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,UAA6C,EAAE;IACxF,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC1B,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,MAAM,aAAa,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC;QAClC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QAC9B,yBAAyB,CAAC,IAAI,CAAC;KAChC,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAsB,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG;QACtB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QAC/B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;KAC1C,CAAC;IACF,MAAM,wBAAwB,GAAG;QAC/B,mBAAmB;QACnB,uBAAuB;QACvB,mBAAmB;QACnB,gCAAgC;QAChC,cAAc;QACd,gBAAgB;QAChB,mBAAmB;QACnB,eAAe;QACf,eAAe;KAChB,CAAC;IACF,8EAA8E;IAC9E,wFAAwF;IACxF,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,kFAAkF;IAClF,gGAAgG;IAChG,2FAA2F;IAC3F,MAAM,oBAAoB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzF,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,wBAAwB,EAAE,GAAG,oBAAoB,CAAC,CAAC,CAAC,CAAC;IACtG,MAAM,cAAc,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;IAC7G,MAAM,SAAS,GACb,UAAU,KAAK,QAAQ;QACrB,CAAC,CAAC;YACE,aAAa;YACb,MAAM;YACN,WAAW;YACX,YAAY;YACZ,UAAU;YACV,GAAG,iBAAiB;YACpB,GAAG,cAAc;YACjB,MAAM;YACN,MAAM;YACN,OAAO;YACP,MAAM;YACN,QAAQ;YACR,MAAM;YACN,UAAU;YACV,iBAAiB;YACjB,YAAY;YACZ,eAAe;SAChB;QACH,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,aAAa,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,iBAAiB,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1E,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,mBAAmB,EAAE,CAAC,iBAAiB,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,cAAc,EAAE,EAAE;YAClB,aAAa,EAAE,CAAC,GAAG,CAAC;YACpB,eAAe,EAAE,IAAI;YACrB,iBAAiB,EAAE,KAAK;SACzB;QACD,UAAU,EAAE;YACV,QAAQ;YACR,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,UAAU;YACV,SAAS,EAAE,EAAE;YACb,cAAc,EAAE,IAAI;SACrB;QACD,WAAW,EAAE;YACX,KAAK,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;YACrF,OAAO,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAe,EAAE,CAAC,CAAC;SAC5E;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,0BAA0B,GACrC,0IAA0I,CAAC"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.d.ts

@@ -0,0 +1,18 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import { type SandboxAvailability, type ShellSandboxRunner } from './sandbox-policy.js';
+export declare class AnthropicShellSandboxRunner implements ShellSandboxRunner {
+    #private;
+    availability(): Promise<SandboxAvailability>;
+    wrap(command: string, options: {
+        cwd: string;
+        config?: SandboxRuntimeConfig;
+        signal?: AbortSignal;
+    }): Promise<{
+        command: string;
+        diagnostics?: string[];
+    }>;
+    cleanupAfterCommand(): void;
+    annotateFailure(command: string, stderr: string): string;
+}
+export declare function getDefaultShellSandboxRunner(): ShellSandboxRunner;
+//# sourceMappingURL=shell-sandbox-runner.d.ts.map

package/dist/utils/shell/sandbox/shell-sandbox-runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox-runner.d.ts","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E,OAAO,EAA8B,KAAK,mBAAmB,EAAE,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,qBAAa,2BAA4B,YAAW,kBAAkB;;IAI9D,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC;IAiB5C,IAAI,CACR,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QACP,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,oBAAoB,CAAC;QAC9B,MAAM,CAAC,EAAE,WAAW,CAAC;KACtB,GACA,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOvD,mBAAmB,IAAI,IAAI;IAI3B,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM;CAwBzD;AAID,wBAAgB,4BAA4B,IAAI,kBAAkB,CAGjE"}

package/dist/utils/shell/sandbox/shell-sandbox-runner.js

@@ -0,0 +1,58 @@
+import { SandboxManager } from '@anthropic-ai/sandbox-runtime';
+import { SANDBOX_TEMP_DIR } from '../temp-dir.js';
+import { createSandboxRuntimeConfig } from './sandbox-policy.js';
+export class AnthropicShellSandboxRunner {
+    #initializedForKey;
+    #initializationFailure;
+    async availability() {
+        if (!SandboxManager.isSupportedPlatform()) {
+            return { type: 'unsupported_platform', reason: 'Sandbox runtime does not support this platform.' };
+        }
+        const dependencyCheck = SandboxManager.checkDependencies();
+        if (dependencyCheck.errors.length > 0) {
+            return { type: 'missing_dependency', reason: dependencyCheck.errors.join('; ') };
+        }
+        if (this.#initializationFailure) {
+            return this.#initializationFailure;
+        }
+        return { type: 'available' };
+    }
+    async wrap(command, options) {
+        await this.#initialize(options.cwd, options.config);
+        const wrapped = await SandboxManager.wrapWithSandbox(command, undefined, undefined, options.signal);
+        const diagnostics = SandboxManager.getLinuxGlobPatternWarnings?.() ?? [];
+        return { command: wrapped, diagnostics };
+    }
+    cleanupAfterCommand() {
+        SandboxManager.cleanupAfterCommand();
+    }
+    annotateFailure(command, stderr) {
+        return SandboxManager.annotateStderrWithSandboxFailures(command, stderr);
+    }
+    async #initialize(cwd, config = createSandboxRuntimeConfig({ cwd })) {
+        const initializationKey = JSON.stringify({ cwd, config });
+        if (this.#initializedForKey === initializationKey) {
+            return;
+        }
+        try {
+            if (this.#initializedForKey) {
+                await SandboxManager.reset();
+            }
+            process.env.CLAUDE_CODE_TMPDIR = SANDBOX_TEMP_DIR;
+            await SandboxManager.initialize(config);
+            this.#initializedForKey = initializationKey;
+            this.#initializationFailure = undefined;
+        }
+        catch (error) {
+            const reason = error instanceof Error ? error.message : String(error);
+            this.#initializationFailure = { type: 'initialization_failed', reason };
+            throw error;
+        }
+    }
+}
+let defaultRunner;
+export function getDefaultShellSandboxRunner() {
+    defaultRunner ??= new AnthropicShellSandboxRunner();
+    return defaultRunner;
+}
+//# sourceMappingURL=shell-sandbox-runner.js.map

package/dist/utils/shell/sandbox/shell-sandbox-runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-sandbox-runner.js","sourceRoot":"","sources":["../../../../source/utils/shell/sandbox/shell-sandbox-runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAqD,MAAM,qBAAqB,CAAC;AAEpH,MAAM,OAAO,2BAA2B;IACtC,kBAAkB,CAAqB;IACvC,sBAAsB,CAAkC;IAExD,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC,cAAc,CAAC,mBAAmB,EAAE,EAAE,CAAC;YAC1C,OAAO,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;QACrG,CAAC;QAED,MAAM,eAAe,GAAG,cAAc,CAAC,iBAAiB,EAAE,CAAC;QAC3D,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACnF,CAAC;QAED,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAChC,OAAO,IAAI,CAAC,sBAAsB,CAAC;QACrC,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,IAAI,CACR,OAAe,EACf,OAIC;QAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACpG,MAAM,WAAW,GAAG,cAAc,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,CAAC;QACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;IAC3C,CAAC;IAED,mBAAmB;QACjB,cAAc,CAAC,mBAAmB,EAAE,CAAC;IACvC,CAAC;IAED,eAAe,CAAC,OAAe,EAAE,MAAc;QAC7C,OAAO,cAAc,CAAC,iCAAiC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAW,EAAE,SAA+B,0BAA0B,CAAC,EAAE,GAAG,EAAE,CAAC;QAC/F,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,kBAAkB,KAAK,iBAAiB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC5B,MAAM,cAAc,CAAC,KAAK,EAAE,CAAC;YAC/B,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,kBAAkB,GAAG,gBAAgB,CAAC;YAClD,MAAM,cAAc,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YACxC,IAAI,CAAC,kBAAkB,GAAG,iBAAiB,CAAC;YAC5C,IAAI,CAAC,sBAAsB,GAAG,SAAS,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,sBAAsB,GAAG,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;CACF;AAED,IAAI,aAAsD,CAAC;AAE3D,MAAM,UAAU,4BAA4B;IAC1C,aAAa,KAAK,IAAI,2BAA2B,EAAE,CAAC;IACpD,OAAO,aAAa,CAAC;AACvB,CAAC"}

package/dist/utils/shell/shell-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell-output.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAsCD,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,UAAU,GACX,EAAE,gCAAgC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA4B9E"}
+{"version":3,"file":"shell-output.d.ts","sourceRoot":"","sources":["../../../source/utils/shell/shell-output.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,QAAQ,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,gCAAgC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyCD,wBAAsB,0BAA0B,CAAC,EAC/C,OAAO,EACP,GAAG,EACH,MAAM,EACN,MAAM,EACN,QAAQ,EACR,QAAQ,EACR,eAAe,EACf,UAAU,GACX,EAAE,gCAAgC,GAAG,OAAO,CAAC,gCAAgC,CAAC,CA0B9E"}

package/dist/utils/shell/shell-output.js

@@ -1,8 +1,10 @@
 import { mkdtemp, writeFile } from 'fs/promises';
+import { randomBytes } from 'crypto';
 import os from 'os';
 import path from 'path';
 import { trimOutput } from '../output/output-trim.js';
-const TRUNCATED_NOTE_PREFIX = 'Full shell output saved to';
+const TRUNCATED_NOTE_PREFIX = 'Full output saved to';
+let shellOutputTempDirPromise;
 function buildArtifactContents(params) {
     const statusLine = params.timedOut ? 'timeout' : `exit ${params.exitCode ?? 'null'}`;
     return [
@@ -21,8 +23,10 @@ function buildArtifactContents(params) {
     ].join('\n');
 }
 async function saveShellOutputArtifact(contents) {
-    const tempDir = await mkdtemp(path.join(os.tmpdir(), 'term2-shell-output-'));
-    const artifactPath = path.join(tempDir, 'output.txt');
+    shellOutputTempDirPromise ??= mkdtemp(path.join(os.tmpdir(), 'term2-shell-output-'));
+    const tempDir = await shellOutputTempDirPromise;
+    const suffix = randomBytes(3).toString('hex');
+    const artifactPath = path.join(tempDir, `output-${suffix}.txt`);
     await writeFile(artifactPath, contents, 'utf8');
     return artifactPath;
 }
@@ -41,9 +45,7 @@ export async function formatShellExecutionOutput({ command, cwd, stdout, stderr,
     if (stdoutTruncated || stderrTruncated) {
         artifactPath = await saveShellOutputArtifact(buildArtifactContents({ command, cwd, stdout, stderr, exitCode, timedOut, durationMs }));
     }
-    const truncationNote = artifactPath
-        ? `${TRUNCATED_NOTE_PREFIX} \`${artifactPath}\`. Search that file for what you need instead of rerunning the command or changing the filter criteria with a \`| grep\` pipeline.`
-        : '';
+    const truncationNote = artifactPath ? `${TRUNCATED_NOTE_PREFIX} \`${artifactPath}\`` : '';
     return {
         text: [statusLine, runtimeLine, combinedOutput, emptyOutputNote, truncationNote].filter(Boolean).join('\n'),
         truncated: Boolean(artifactPath),