@ravefox/space 0.2.0 → 0.3.0

package/src/lib/sandbox/bwrap.js

@@ -1,275 +0,0 @@
-/**
- * bubblewrap sandbox adapter — ADR-008 Phase 1.
- *
- * Wraps an inner adapter argv (e.g. claude -p ...) in a bwrap invocation that
- * pins the spawn into a workspace, isolates the network namespace, and
- * read-only-binds a small allowlist of host paths the adapter needs to start
- * (TLS certs, libc, the binary itself).
- *
- * Linux-only by design: bwrap is a setuid Linux helper. macOS callers get a
- * loud, specific error at attach time so the failure shape never reaches run.
- *
- * Detection idiom mirrors `claude.js#detect`: spawnSync with --version, treat
- * non-zero or spawn error as "not available."
- */
-
-import { spawnSync } from 'child_process';
-import { existsSync, readFileSync } from 'fs';
-import { isAbsolute, join } from 'path';
-import { homedir } from 'os';
-
-// Tilde-expansion lives here (and not in environment.js's expandHome) because
-// bwrap reads OS-level paths verbatim — `~` is a shell construct, not a
-// kernel one, so any `~/foo` entry in `read-outside` / `write-outside` would
-// be passed literally to `--ro-bind-try` and silently skipped (the `-try`
-// variant tolerates missing paths). Surfaced live during the 2026-04-17
-// demo validation: `~/.local/bin` was declared but `claude` still wasn't
-// reachable inside the sandbox.
-const expandHome = (p) => {
-  if (!p || typeof p !== 'string') return p;
-  if (p === '~') return homedir();
-  if (p.startsWith('~/')) return join(homedir(), p.slice(2));
-  return p;
-};
-
-// Never advise `sandbox.mode: none` here: a public seat refuses it, and the
-// mechanisms that do exist are named instead.
-const MACOS_MESSAGE = 'bwrap is Linux-only. On macOS a public seat runs under Seatbelt '
-  + '(sandbox.mode workspace or read-only).';
-// D245: native Windows has no sandbox for agents. WSL runs the Linux one,
-// Claude Code included since F96, and host-check.js offers it; this message
-// names the native path, which is the user's own opt-in
-// (sandbox/windows-unsandboxed.js).
-const WINDOWS_MESSAGE = 'bwrap is Linux-only, and native Windows has no sandbox for agents yet. '
-  + 'To run this agent without one, with your own access to files and commands, add --unsandboxed.';
-const nonLinuxMessage = (platform) => (platform === 'win32' ? WINDOWS_MESSAGE : MACOS_MESSAGE);
-
-const DEFAULT_RO_BINDS = [
-  '/etc/ssl/certs',
-  '/etc/resolv.conf',
-  '/usr/lib',
-  '/usr/lib64',
-  '/usr/bin',
-  '/bin',
-  '/lib',
-  '/lib64',
-];
-
-/**
- * What a bwrap sandbox binds for reading, as roots (F453): the default binds
- * plus the seat's declared read-outside and write-outside, tilde-expanded the
- * way wrapArgvWithBwrap expands them. A caller keeping a secret out of the
- * sandbox (a public seat's provider key file) checks against this rather than
- * a copy of the bind list. Per-turn paths (workspace, state, adapter inputs)
- * are the caller's.
- */
-export const bwrapReadRoots = (env) => {
-  const declared = (key) => (Array.isArray(env?.sandbox?.filesystem?.[key])
-    ? env.sandbox.filesystem[key].map(expandHome) : []);
-  return {
-    subpaths: [...new Set([...DEFAULT_RO_BINDS, ...declared('read-outside'), ...declared('write-outside')])],
-    literals: [],
-  };
-};
-
-// `bwrap --version` only proves the binary is there. On Ubuntu 24.04 and later
-// AppArmor restricts unprivileged user namespaces, so bwrap is installed and
-// every sandbox it starts fails (`setting up uid map: Permission denied`,
-// ubuntu run 38982219348). Starting one empty namespace is the real check.
-const NAMESPACE_PROBE = ['--unshare-all', '--ro-bind', '/', '/', 'true'];
-
-const APPARMOR_USERNS_SYSCTL = '/proc/sys/kernel/apparmor_restrict_unprivileged_userns';
-
-// Inside a container the sysctl reports the host, and what blocks bwrap is the
-// container's own policy, so the host's AppArmor is not the person's way out.
-// Docker leaves /.dockerenv, Podman /run/.containerenv, and systemd writes
-// /run/systemd/container inside a container (nspawn, LXC), never on a host.
-// The filesystem is injectable for the tests.
-const CONTAINER_MARKERS = ['/.dockerenv', '/run/.containerenv', '/run/systemd/container'];
-export const readApparmorRestriction = ({ read = readFileSync, exists = existsSync } = {}) => {
-  if (CONTAINER_MARKERS.some((marker) => exists(marker))) return false;
-  try {
-    return read(APPARMOR_USERNS_SYSCTL, 'utf8').trim() === '1';
-  } catch {
-    return false;
-  }
-};
-
-// os-release values may be quoted, so `ID="ubuntu"` reads the same as `ID=ubuntu`.
-// /etc/os-release wins; /usr/lib/os-release is the file it normally links to,
-// read only when the first is missing.
-const readOsRelease = (read) => {
-  try {
-    return read('/etc/os-release', 'utf8');
-  } catch {
-    return read('/usr/lib/os-release', 'utf8');
-  }
-};
-export const readUbuntuRelease = ({ read = readFileSync } = {}) => {
-  try {
-    const release = readOsRelease(read);
-    if (!/^ID=(["']?)ubuntu\1$/m.test(release)) return null;
-    // The last assignment wins, as it does when a shell sources the file.
-    const versions = [...release.matchAll(/^VERSION_ID=(["']?)([\d.]+)\1$/gm)];
-    return versions.at(-1)?.[2] ?? null;
-  } catch {
-    return null;
-  }
-};
-
-export const detectBwrap = ({
-  spawn = spawnSync,
-  platform = process.platform,
-  readRestriction = readApparmorRestriction,
-  readRelease = readUbuntuRelease,
-} = {}) => {
-  if (platform !== 'linux') {
-    return { available: false, error: nonLinuxMessage(platform) };
-  }
-  try {
-    const res = spawn('bwrap', ['--version'], { encoding: 'utf8' });
-    if (res.error || res.status !== 0) {
-      return {
-        available: false,
-        error: 'bwrap not found on PATH. Install bubblewrap: `sudo apt install bubblewrap` (Debian/Ubuntu, WSL), '
-          + '`sudo dnf install bubblewrap` (Fedora) or `sudo pacman -S bubblewrap` (Arch).',
-      };
-    }
-    const probe = spawn('bwrap', NAMESPACE_PROBE, { encoding: 'utf8', timeout: 10_000 });
-    if (probe.error || probe.status !== 0) {
-      const reason = (probe.stderr || probe.error?.message || `exit ${probe.status}`).trim().split('\n').pop();
-      return {
-        available: false,
-        // Only when bwrap ran and exited refusing: a probe that timed out or
-        // couldn't spawn says nothing about this host.
-        namespaceRefused: !probe.error && typeof probe.status === 'number',
-        reason,
-        apparmorRestricted: readRestriction(),
-        ubuntuRelease: readRelease(),
-        error: `bubblewrap is installed but cannot start a sandbox on this machine (${reason}). `
-          + 'On Ubuntu 24.04 and later, AppArmor restricts the unprivileged user namespaces it needs.',
-      };
-    }
-    return { available: true, path: 'bwrap' };
-  } catch (err) {
-    return { available: false, error: `bwrap detection failed: ${err.message}` };
-  }
-};
-
-/**
- * Build the bwrap-wrapped argv. Caller spawns argv[0] with argv.slice(1).
- *
- * Network policy honesty (ADR-008 §invariant #4 informs this):
- *   - unrestricted → --share-net (host networking inside the namespace)
- *   - restricted   → --unshare-net (no external network). OpenCode may opt
- *     into a private loopback bridge to its per-spawn Unix-socket proxy.
- *     Host-allowlist filtering is not supplied by bwrap itself.
- *
- * The expansion order matches `bwrap`'s left-to-right argument application:
- * isolation flags first, then binds (later binds win on collision), then the
- * isolated HOME, then `--` and the inner argv. The caller passes the filtered
- * child environment as the bwrap process environment; values must not be
- * serialized into argv, where they would be visible in the process list.
- */
-export const wrapArgvWithBwrap = (innerArgv, env, opts = {}) => {
-  if (process.platform !== 'linux') {
-    throw new Error(nonLinuxMessage(process.platform));
-  }
-  if (!Array.isArray(innerArgv) || innerArgv.length === 0) {
-    throw new Error('wrapArgvWithBwrap requires a non-empty innerArgv');
-  }
-  if (!opts.workspacePath || !isAbsolute(opts.workspacePath)) {
-    throw new Error('wrapArgvWithBwrap requires opts.workspacePath as an absolute path');
-  }
-
-  const policy = env?.sandbox?.network?.policy || 'unrestricted';
-  const networkFlags = policy === 'restricted'
-    ? ['--unshare-net']
-    : ['--share-net'];
-  if (opts.enableLoopback && policy !== 'restricted') {
-    throw new Error('bwrap loopback bridge requires an isolated network namespace');
-  }
-
-  const flags = [
-    '--unshare-all',
-    ...networkFlags,
-    ...(opts.enableLoopback ? [
-      '--uid', '0', '--gid', '0',
-      '--cap-add', 'CAP_NET_ADMIN', '--cap-add', 'CAP_SETPCAP',
-    ] : []),
-    '--die-with-parent',
-    '--new-session',
-    '--proc', '/proc',
-    '--dev', '/dev',
-    '--tmpfs', '/tmp',
-  ];
-
-  const userReadOutside = Array.isArray(env?.sandbox?.filesystem?.['read-outside'])
-    ? env.sandbox.filesystem['read-outside'].map(expandHome)
-    : [];
-  const roBinds = [...new Set([...DEFAULT_RO_BINDS, ...userReadOutside])];
-  for (const p of roBinds) {
-    flags.push('--ro-bind-try', p, p);
-  }
-
-  const userWriteOutside = Array.isArray(env?.sandbox?.filesystem?.['write-outside'])
-    ? env.sandbox.filesystem['write-outside'].map(expandHome)
-    : [];
-  for (const p of userWriteOutside) {
-    flags.push('--bind-try', p, p);
-  }
-
-  // Adapter-owned transient inputs (for example Claude's per-spawn MCP
-  // config) live outside the workspace so model-visible Read(./**) cannot
-  // reach them. Bind only the exact directories the adapter prepared; they
-  // remain read-only inside the namespace and disappear after the spawn.
-  for (const p of opts.readOnlyPaths || []) {
-    if (!p || !isAbsolute(p)) {
-      throw new Error('wrapArgvWithBwrap opts.readOnlyPaths entries must be absolute paths');
-    }
-    flags.push('--ro-bind', p, p);
-  }
-  for (const p of opts.optionalReadOnlyPaths || []) {
-    if (!p || !isAbsolute(p)) {
-      throw new Error('wrapArgvWithBwrap opts.optionalReadOnlyPaths entries must be absolute paths');
-    }
-    flags.push('--ro-bind-try', p, p);
-  }
-
-  // A HOME the adapter keeps outside the workspace (a workspace seat's state)
-  // is bound writable on its own, so the child's transcripts and login stay
-  // out of the person's project.
-  for (const p of opts.writablePaths || []) {
-    if (!p || !isAbsolute(p)) {
-      throw new Error('wrapArgvWithBwrap opts.writablePaths entries must be absolute paths');
-    }
-    flags.push('--bind', p, p);
-  }
-
-  // The folder mounted at workspacePath: workspaceSource when the caller has
-  // already resolved and checked it, so the mount cannot follow a link that
-  // replaced the folder after that check.
-  const workspaceSource = opts.workspaceSource || opts.workspacePath;
-  if (!isAbsolute(workspaceSource)) {
-    throw new Error('wrapArgvWithBwrap opts.workspaceSource must be an absolute path');
-  }
-  flags.push(opts.workspaceReadOnly ? '--ro-bind' : '--bind', workspaceSource, opts.workspacePath);
-  // Entries held read-only inside a writable workspace (its .git). Bound after
-  // the workspace so they land on top of it. In a writable workspace a missing
-  // entry cannot be protected — the child could create it, and a planted
-  // .git/hooks runs on the person's next git command — so the bind is strict
-  // there and bwrap fails rather than starts.
-  for (const entry of opts.readOnlyWorkspaceEntries || []) {
-    if (!entry || isAbsolute(entry) || entry.split(/[\\/]/).includes('..')) {
-      throw new Error('wrapArgvWithBwrap opts.readOnlyWorkspaceEntries entries must be relative names inside the workspace');
-    }
-    flags.push(opts.workspaceReadOnly ? '--ro-bind-try' : '--ro-bind',
-      join(workspaceSource, entry), join(opts.workspacePath, entry));
-  }
-  flags.push('--chdir', opts.workspacePath);
-  flags.push('--setenv', 'HOME', opts.homePath || opts.workspacePath);
-
-  return ['bwrap', ...flags, '--', ...innerArgv];
-};
-
-export const BWRAP_MACOS_MESSAGE = MACOS_MESSAGE;

package/src/lib/sandbox/codex-perimeter.js

@@ -1,16 +0,0 @@
-/**
- * F387: a cloud-codex k8s pod declares itself with this env var, set only by
- * k8s/helm/commonly/templates/agents/cloud-codex-deployment.yaml. bwrap can't
- * run in a standard k8s container and the pod is the boundary, so a Codex seat
- * there keeps the pod's execution policy. Anywhere else a private Codex seat
- * runs under the private permission profile (adapters/codex.js); on Linux it
- * is refused by default until that profile is walked there (host-check.js).
- *
- * Only the exact value "1" counts, so a missing or mistyped value lands on the
- * profile.
- */
-export const CODEX_TRUSTED_PERIMETER_ENV = 'COMMONLY_CODEX_TRUSTED_PERIMETER';
-
-export const codexTrustedPerimeter = (env = process.env) => (
-  String(env?.[CODEX_TRUSTED_PERIMETER_ENV] ?? '').trim() === '1'
-);

package/src/lib/sandbox/host-check.js

@@ -1,268 +0,0 @@
-/**
- * Can THIS host confine the seat it is about to run? Asked once, before the
- * first poll.
- *
- * A public seat's sandbox is resolved per host (mode.js): Seatbelt on macOS,
- * bubblewrap elsewhere. `agent attach --env` checks that mechanism up front;
- * `agent run` did not, so a public seat on a host without it (native Windows,
- * or Linux without bubblewrap) would start, poll, and fail every turn while
- * the pod saw nothing.
- *
- * Only the adapters that run inside these mechanisms are checked. Codex
- * confines with its own permission profiles (mode.js), except on native
- * Windows: there a public Codex seat is refused, and any other runs only by the
- * person's own opt-in (CODEX_WINDOWS_MESSAGE below). pi confines an
- * explicitly public seat with Seatbelt and refuses one it cannot confine at
- * attach (validateEnvironment) and at spawn (adapters/pi.js); a Connect-page pi
- * seat declares no sandbox and is not checked here.
- */
-
-import { normalizeSandboxTrust } from '../environment.js';
-import { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode } from './mode.js';
-import { detectBwrap as defaultDetectBwrap } from './bwrap.js';
-import { detectSeatbelt as defaultDetectSeatbelt } from './seatbelt.js';
-import { codexTrustedPerimeter } from './codex-perimeter.js';
-import { CLI } from '../cli-hint.js';
-
-// D245: the Windows opt-in (windows-unsandboxed.js re-exports it; defined here to avoid an import cycle).
-export const UNSANDBOXED_FLAG = '--unsandboxed';
-
-// The Seatbelt modes come from mode.js, as grant-broker-guard's do, so a mode
-// added there is not silently missing here.
-const SEATBELT_MODES = PUBLIC_SANDBOX_MODES;
-
-const ADAPTER_LABELS = { claude: 'Claude Code', codex: 'Codex', opencode: 'OpenCode', qwen: 'Qwen Code' };
-
-const HOSTED_LINE = '  - A hosted agent: choose "Run it here" on the Connect page. Nothing runs on this machine.';
-
-const CODEX_WSL_LINE = '  - WSL 2 (Ubuntu): install Node and Codex inside WSL, run `sudo apt install bubblewrap`,'
-  + ' then run these same commands there.';
-
-/**
- * Codex's unelevated Windows sandbox cannot enforce the split read denies a
- * public seat's profile carries ("refusing to run unsandboxed"), and Codex has
- * no tool policy beneath that profile, so an unconfined Codex is a full shell
- * driven by pod content. That is why a public Codex seat on native Windows
- * always refuses, and why even the opt-in reaches only a seat whose every pod
- * is confirmed private (windows-unsandboxed.js), re-read before every turn.
- * Codex's elevated Windows sandbox is the hardened path; Commonly doesn't drive
- * it yet.
- */
-const CODEX_WINDOWS_MESSAGE = [
-  "Codex can't enforce a sandbox on Windows without its elevated setup,",
-  'so by default this agent cannot listen for @mentions from native Windows. You can:',
-  `  - In invite-only pods, run it without a sandbox: add ${UNSANDBOXED_FLAG}`
-    + ` (${CLI} agent run <name> ${UNSANDBOXED_FLAG}, or ${CLI} daemon install ${UNSANDBOXED_FLAG}).`
-    + ' Nothing confines it: it runs with your own access to files and commands, anyone in the pod,'
-    + ' people you invite later included, can direct it, and it gets no connector grants.',
-  CODEX_WSL_LINE,
-  HOSTED_LINE,
-].join('\n');
-
-// The seat can't take the flag: its pods rule it out, or it declares itself
-// public. Naming the flag would only send the person round in a circle.
-const CODEX_WINDOWS_PUBLIC_MESSAGE = [
-  'This agent is public: its settings say so, or a pod it answers in is publicly readable or open to join,',
-  "or did not report whether it is. A public agent needs a sandbox, which Codex can't enforce on Windows"
-    + ' without its elevated setup. You can:',
-  CODEX_WSL_LINE,
-  HOSTED_LINE,
-].join('\n');
-
-const CLAUDE_MCP_LINE = '  - Use Space from your own Claude Code sessions: the Connect page shows a `claude mcp add` command.';
-
-// Claude Code and Codex each answered on prod under this profile, on a fresh
-// Ubuntu 24.04 runner (byo-linux.yml runs 42398237284, 42398763392), so only
-// they are offered it. Printed for the person to run; nothing here runs it. It
-// stays the last and optional route, and the sysctl behind the restriction is
-// never named as a way out. The lines take the one file out of the package:
-// installing apparmor-profiles enforces 21 more profiles at once, among them
-// ping, dnsmasq and smbd (run 42400201955), which nobody here agreed to.
-// The subshell keeps the person in their project folder, which a first run on a
-// private pod binds to, and stops at the first failure. byo-linux.yml runs these
-// exact lines.
-export const UBUNTU_BWRAP_PROFILE_COMMANDS = [
-  'sudo apt-get update',
-  '(cd "$(mktemp -d)" && apt-get download apparmor-profiles && dpkg-deb -x apparmor-profiles_*.deb .'
-    + ' && sudo cp usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/)',
-  'sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict',
-];
-
-export const UBUNTU_BWRAP_PROFILE_UNDO = [
-  'sudo apparmor_parser -R /etc/apparmor.d/bwrap-userns-restrict',
-  'sudo rm /etc/apparmor.d/bwrap-userns-restrict',
-];
-
-const UBUNTU_BWRAP_PROFILE_LINES = [
-  "  - Optional, if you'd rather run it on this machine: load Ubuntu's own AppArmor profile for bubblewrap.",
-  '    It lets any program here use bubblewrap to create user namespaces; what bubblewrap starts gets no special',
-  "    capabilities. It's your call, it needs sudo, and Space never runs it for you. We tested it on a fresh",
-  "    Ubuntu 24.04 server image, not on every machine. These lines load that one profile and nothing else from",
-  "    Ubuntu's package:",
-  ...UBUNTU_BWRAP_PROFILE_COMMANDS.map((line) => `      ${line}`),
-  '    Then run the same command again. To undo it:',
-  ...UBUNTU_BWRAP_PROFILE_UNDO.map((line) => `      ${line}`),
-];
-
-/** bubblewrap is installed and this host refused it a sandbox. */
-export const bwrapRefusedMessage = (adapterName, { reason, apparmorRestricted, ubuntuRelease }) => {
-  const label = ADAPTER_LABELS[adapterName] || adapterName;
-  // 24.04 only: the file moves or is absent on other releases.
-  const offersProfile = apparmorRestricted === true && ubuntuRelease === '24.04'
-    && (adapterName === 'claude' || adapterName === 'codex');
-  return [
-    `A connected ${label} runs inside a bubblewrap sandbox, and this machine won't let bubblewrap start one (${reason}).`,
-    ...(apparmorRestricted === true
-      ? ['AppArmor on Ubuntu 24.04 and later restricts the user namespaces bubblewrap needs.']
-      : []),
-    'So this agent cannot listen for @mentions here yet. You can:',
-    HOSTED_LINE,
-    ...(adapterName === 'claude' ? [CLAUDE_MCP_LINE] : []),
-    ...(offersProfile ? UBUNTU_BWRAP_PROFILE_LINES : []),
-  ].join('\n');
-};
-
-const CODEX_UNSANDBOXED_RUN_LINE = `  - In invite-only pods, run it without a sandbox: ${CLI} agent run <name> ${UNSANDBOXED_FLAG}`
-  + ' (in the foreground; the daemon takes this only on Windows).'
-  + ' Nothing confines it: it runs with your own access to files and commands, anyone in the pod,'
-  + ' people you invite later included, can direct it, and it gets no connector grants.';
-
-/**
- * F387, F444: a private Codex seat on Linux runs under Codex's own sandbox,
- * which uses bubblewrap there. Where bubblewrap can't start one, the seat is
- * refused before its first poll, with the fix for this host. The person can
- * run it unconfined by their own choice, as on native Windows; it never falls
- * back to that without being asked.
- */
-export const codexPrivateLinuxMessage = (bwrap = {}, { optedIn = false } = {}) => {
-  const refused = bwrap.namespaceRefused === true;
-  const offersProfile = refused && bwrap.apparmorRestricted === true && bwrap.ubuntuRelease === '24.04';
-  return [
-    'A private Codex agent runs inside Codex\'s own sandbox, which keeps your other credentials out of its reach'
-      + ` and uses bubblewrap on Linux. ${refused
-        ? `This machine won't let bubblewrap start one (${bwrap.reason}).`
-        : (bwrap.error || 'bubblewrap was not found.')}`,
-    ...(refused && bwrap.apparmorRestricted === true
-      ? ['AppArmor on Ubuntu 24.04 and later restricts the user namespaces bubblewrap needs.']
-      : []),
-    ...(optedIn
-      ? ['A pod this agent answers in is publicly readable or open to join, or did not report whether it is,'
-        + ' so it cannot run without a sandbox either.']
-      : []),
-    'So this agent cannot listen for @mentions here yet. You can:',
-    ...(refused ? [] : ['  - Install bubblewrap (`sudo apt install bubblewrap`) and run the same command again.']),
-    ...(optedIn ? [] : [CODEX_UNSANDBOXED_RUN_LINE]),
-    HOSTED_LINE,
-    ...(offersProfile ? UBUNTU_BWRAP_PROFILE_LINES : []),
-  ].join('\n');
-};
-
-// The person opted in, and a pod rules it out, so the turn has no sandbox to
-// fall back to on any platform. Naming the flag again would only send them
-// round in a circle.
-export const CODEX_OPTED_IN_PUBLIC_POD_MESSAGE = [
-  'A pod this agent answers in is publicly readable or open to join, or did not report whether it is,',
-  'so it cannot run without a sandbox. You can:',
-  HOSTED_LINE,
-].join('\n');
-
-/** What a person on native Windows can do instead. */
-export const windowsSandboxMessage = (adapterName) => {
-  if (adapterName === 'codex') return CODEX_WINDOWS_MESSAGE;
-  const label = ADAPTER_LABELS[adapterName] || adapterName;
-  // WSL runs the Linux sandbox, which carries every adapter, Claude Code
-  // included (F96). Claude Code also has the MCP command, which needs none.
-  return [
-    `Space runs a connected ${label} inside a sandbox, and has no sandbox for Windows yet,`,
-    'so by default this agent cannot listen for @mentions from native Windows. You can:',
-    `  - WSL 2 (Ubuntu): install Node and ${label} inside WSL, run \`sudo apt install bubblewrap\`,`
-      + ' then run these same commands there.',
-    // D245: the user's own choice, never a default (sandbox/windows-unsandboxed.js).
-    ...(adapterName === 'claude'
-      ? [`  - Run it without an OS sandbox: add ${UNSANDBOXED_FLAG}`
-        + ` (${CLI} agent run <name> ${UNSANDBOXED_FLAG}, or ${CLI} daemon install ${UNSANDBOXED_FLAG}).`
-        + " It keeps Space's restricted tool settings and gets no shell, but nothing at the OS level confines it, and it gets no connector grants."]
-      : []),
-    ...(adapterName === 'claude'
-      ? ['  - Use Space from your own Claude Code sessions: the Connect page shows a PowerShell `claude mcp add` command.']
-      : []),
-    HOSTED_LINE,
-  ].join('\n');
-};
-
-/** Why this host cannot confine the seat, or null when it can (or the seat declares no sandbox). */
-export const hostSandboxRefusal = ({
-  environment,
-  adapterName,
-  platform = process.platform,
-  // D245: the user's own opt-in for this run (windows-unsandboxed.js
-  // hostUnconfinedForRun). Never derived from the environment.
-  hostUnconfined = false,
-  // The person asked for the opt-in, whether or not the seat qualified. Only
-  // chooses Codex's words: it never lets a seat through.
-  optedIn = false,
-  detectBwrap = defaultDetectBwrap,
-  detectSeatbelt = defaultDetectSeatbelt,
-  // F387: a cloud-codex pod declares itself here (codex-perimeter.js).
-  env = process.env,
-} = {}) => {
-  if (adapterName === 'codex') {
-    // Keyed on trust, not mode: Codex resolves no Seatbelt or bwrap mode of its
-    // own, and a legacy `internal` normalizes to public. Workspace trust is
-    // left to Codex's own refusal, at attach and at spawn on every platform,
-    // so WSL advice would only send that seat to a second refusal.
-    const trust = normalizeSandboxTrust(environment?.sandbox)?.trust;
-    if (platform === 'linux' && trust === 'public') {
-      // Codex's own sandbox uses bubblewrap here. Refused a namespace, every
-      // turn dies at session start and the pod hears nothing (run 42398478814).
-      // A missing bwrap stays Codex's own to report.
-      const bwrap = detectBwrap();
-      return bwrap.namespaceRefused === true ? bwrapRefusedMessage(adapterName, bwrap) : null;
-    }
-    // F387, F444: a private seat outside a cloud-codex pod runs under the
-    // private permission profile, which Codex enforces with bubblewrap on Linux
-    // (walked on byo-linux.yml, walk=private-codex). Where bubblewrap can't
-    // start, every turn would fail at session start, so the seat is refused
-    // before its first poll, unless the person ran it unconfined by their own
-    // --unsandboxed (D245, as on Windows: only with every pod confirmed
-    // private). Never unconfined without being asked.
-    if (platform === 'linux' && trust !== 'workspace' && !codexTrustedPerimeter(env)) {
-      if (hostUnconfined === true) return null;
-      const bwrap = detectBwrap();
-      if (bwrap.available) return null;
-      return codexPrivateLinuxMessage(bwrap, { optedIn: optedIn === true });
-    }
-    if (platform !== 'win32') return null;
-    if (trust === 'workspace') return null;
-    if (trust === 'public') return optedIn === true ? CODEX_WINDOWS_PUBLIC_MESSAGE : CODEX_WINDOWS_MESSAGE;
-    // No public trust: `agent run` removed the block for this run after
-    // confirming every pod private, or the seat never had one. Either way it
-    // would run unconfined, which only the person's own opt-in allows.
-    if (hostUnconfined === true) return null;
-    return optedIn === true ? CODEX_WINDOWS_PUBLIC_MESSAGE : CODEX_WINDOWS_MESSAGE;
-  }
-  if (!Object.prototype.hasOwnProperty.call(ADAPTER_LABELS, adapterName)) return null;
-  const sandbox = normalizeSandboxTrust(environment?.sandbox);
-  if (!sandbox || typeof sandbox !== 'object') return null;
-  // Every host-confined trust (public, and workspace since TASK-294) derives its
-  // mode here; any other trust gets back only the mode it declared.
-  const mode = sandbox.mode ?? resolvePublicSandboxMode(sandbox, platform);
-  if (mode !== 'bwrap' && !SEATBELT_MODES.has(mode)) return null;
-
-  if (platform === 'win32') {
-    return hostUnconfined === true && adapterName === 'claude' ? null : windowsSandboxMessage(adapterName);
-  }
-  if (mode === 'bwrap') {
-    const bwrap = detectBwrap();
-    if (bwrap.available) return null;
-    return bwrap.namespaceRefused === true
-      ? bwrapRefusedMessage(adapterName, bwrap)
-      : `This seat runs in a bubblewrap sandbox, which is not available here. ${bwrap.error}`;
-  }
-  const seatbelt = detectSeatbelt();
-  return seatbelt.available
-    ? null
-    : `This seat runs in a macOS Seatbelt sandbox (sandbox.mode=${mode}), which is not available here. ${seatbelt.error}`;
-};
-
-export default { hostSandboxRefusal, windowsSandboxMessage };

package/src/lib/sandbox/mode.js

@@ -1,49 +0,0 @@
-/**
- * Which host mechanism enforces a public seat.
- *
- * A stored environment is platform-independent and the host is not. The daemon
- * derives `sandbox: { trust: 'public' }` with NO mode (lib/default-environment.js)
- * because `mode: 'workspace'` is Seatbelt on macOS and is refused on Linux,
- * while `mode: 'bwrap'` is meaningless on macOS — writing either into the row
- * moves a host fact into the database and breaks the day the seat is re-homed.
- *
- * So the mode is resolved here, at the point that knows the host:
- *   darwin  → 'workspace' (the claude adapter maps it to Seatbelt)
- *   else    → 'bwrap'     (bubblewrap; attach checks it is installed)
- *
- * Resolution is PUBLIC-only on purpose, and PUBLIC IS THE EFFECTIVE TRUST: a
- * legacy `internal` declaration reads as `public` (environment.js),
- * so the mapping is applied before this comparison. Comparing the raw value
- * made `{ trust: 'internal' }` resolve to no mode at all — the mapping was
- * applied in `confinementReason` and not here, which is half a rule, and the
- * half that failed was the one that WITHHOLDS: the grant broker was taken from
- * a seat this daemon would have confined. A non-public declaration keeps
- * whatever mode it wrote, and an adapter that cannot enforce it is expected to
- * refuse rather than quietly spawn unconfined. An explicit mode on a public
- * declaration still wins — including a wrong one, which the caller then refuses
- * (an unresolvable public mode must not fall through to a bare,
- * unconfined spawn).
- *
- * NOT used by the codex adapter. Codex's `mode` is read-vs-write access, not a
- * host mechanism — its permission profiles run on both platforms — so its
- * derived default is 'workspace' everywhere.
- *
- * A `workspace` trust (TASK-294) resolves the same way: it is confined by the
- * same host mechanism and differs only in what the policy inside allows. The
- * grant-broker guard still reads the trust itself, not this mode, so resolving
- * it here does not make a workspace seat eligible for a room grant.
- */
-import { effectiveSandboxTrust } from '../environment.js';
-
-export const PUBLIC_SANDBOX_MODES = new Set(['workspace', 'read-only']);
-
-const HOST_CONFINED_TRUSTS = new Set(['public', 'workspace']);
-
-export const resolvePublicSandboxMode = (sandbox, platform = process.platform) => {
-  const declared = sandbox?.mode;
-  if (!HOST_CONFINED_TRUSTS.has(effectiveSandboxTrust(sandbox?.trust))) return declared;
-  if (declared !== undefined && declared !== null) return declared;
-  return platform === 'darwin' ? 'workspace' : 'bwrap';
-};
-
-export default { PUBLIC_SANDBOX_MODES, resolvePublicSandboxMode };