@rosthq/cli 0.7.29 → 0.7.30

package/dist/index.js

@@ -472,13 +472,13 @@ function __disposeResources(env) {
   }
   return next();
 }
-function __rewriteRelativeImportExtension(path5, preserveJsx) {
-  if (typeof path5 === "string" && /^\.\.?\//.test(path5)) {
-    return path5.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
+function __rewriteRelativeImportExtension(path6, preserveJsx) {
+  if (typeof path6 === "string" && /^\.\.?\//.test(path6)) {
+    return path6.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function(m, tsx, d, ext, cm) {
       return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : d + ext + "." + cm.toLowerCase() + "js";
     });
   }
-  return path5;
+  return path6;
 }
 var extendStatics, __assign, __createBinding, __setModuleDefault, ownKeys, _SuppressedError, tslib_es6_default;
 var init_tslib_es6 = __esm({
@@ -13257,7 +13257,7 @@ var require_main3 = __commonJS({
 });
 
 // src/index.ts
-import { realpathSync as realpathSync2 } from "node:fs";
+import { realpathSync as realpathSync3 } from "node:fs";
 import { fileURLToPath as fileURLToPath3, pathToFileURL } from "node:url";
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
@@ -14026,10 +14026,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path5) {
-  if (!path5)
+function getElementAtPath(obj, path6) {
+  if (!path6)
     return obj;
-  return path5.reduce((acc, key) => acc?.[key], obj);
+  return path6.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -14438,11 +14438,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path5, issues) {
+function prefixIssues(path6, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path5);
+    iss.path.unshift(path6);
     return iss;
   });
 }
@@ -14589,16 +14589,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -14625,17 +14625,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path5 = []) => {
+  const processError = (error52, path6 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path5, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path6, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path5, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path6, ...issue2.path]);
       } else {
-        const fullpath = [...path5, ...issue2.path];
+        const fullpath = [...path6, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -14667,8 +14667,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path5 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path5) {
+  const path6 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path6) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -27360,13 +27360,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path5 = ref.slice(1).split("/").filter(Boolean);
-  if (path5.length === 0) {
+  const path6 = ref.slice(1).split("/").filter(Boolean);
+  if (path6.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path5[0] === defsKey) {
-    const key = path5[1];
+  if (path6[0] === defsKey) {
+    const key = path6[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -27828,7 +27828,7 @@ var CommandClient = class {
     this.fetchImpl = options.fetchImpl ?? fetch;
   }
   async execute(commandId, body = {}, options = {}) {
-    const path5 = `/api/commands/${encodeURIComponent(commandId)}`;
+    const path6 = `/api/commands/${encodeURIComponent(commandId)}`;
     const headers = {
       authorization: `Bearer ${this.token}`,
       "content-type": "application/json"
@@ -27836,7 +27836,7 @@ var CommandClient = class {
     if (options.targetSeatId !== void 0 && options.targetSeatId.length > 0) {
       headers["x-rost-seat"] = options.targetSeatId;
     }
-    const response = await this.fetchImpl(`${this.appUrl}${path5}`, {
+    const response = await this.fetchImpl(`${this.appUrl}${path6}`, {
       method: "POST",
       headers,
       body: JSON.stringify(body)
@@ -27849,7 +27849,7 @@ var CommandClient = class {
       const snippet = redactSecrets(text.replace(/\s+/g, " ").trim()).slice(0, 200);
       throw new CommandClientError(
         response.status,
-        `server returned HTTP ${response.status} (non-JSON) from ${path5}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
+        `server returned HTTP ${response.status} (non-JSON) from ${path6}` + (snippet ? ` \u2014 ${snippet}` : "") + " \u2014 the deployment may be unhealthy"
       );
     }
     const parsed = commandResponseSchema.parse(raw);
@@ -33064,8 +33064,8 @@ var IcebergError = class extends Error {
     return this.status === 419;
   }
 };
-function buildUrl(baseUrl, path5, query) {
-  const url2 = new URL(path5, baseUrl);
+function buildUrl(baseUrl, path6, query) {
+  const url2 = new URL(path6, baseUrl);
   if (query) {
     for (const [key, value] of Object.entries(query)) {
       if (value !== void 0) {
@@ -33095,12 +33095,12 @@ function createFetchClient(options) {
   return {
     async request({
       method,
-      path: path5,
+      path: path6,
       query,
       body,
       headers
     }) {
-      const url2 = buildUrl(options.baseUrl, path5, query);
+      const url2 = buildUrl(options.baseUrl, path6, query);
       const authHeaders = await buildAuthHeaders(options.auth);
       const res = await fetchFn(url2, {
         method,
@@ -33962,7 +33962,7 @@ var StorageFileApi = class extends BaseApiClient {
   * @param path The relative file path. Should be of the format `folder/subfolder/filename.png`. The bucket must already exist before attempting to upload.
   * @param fileBody The body of the file to be stored in the bucket.
   */
-  async uploadOrUpdate(method, path5, fileBody, fileOptions) {
+  async uploadOrUpdate(method, path6, fileBody, fileOptions) {
     var _this = this;
     return _this.handleOperation(async () => {
       let body;
@@ -33986,7 +33986,7 @@ var StorageFileApi = class extends BaseApiClient {
         if ((typeof ReadableStream !== "undefined" && body instanceof ReadableStream || body && typeof body === "object" && "pipe" in body && typeof body.pipe === "function") && !options.duplex) options.duplex = "half";
       }
       if (fileOptions === null || fileOptions === void 0 ? void 0 : fileOptions.headers) for (const [key, value] of Object.entries(fileOptions.headers)) headers = setHeader(headers, key, value);
-      const cleanPath = _this._removeEmptyFolders(path5);
+      const cleanPath = _this._removeEmptyFolders(path6);
       const _path = _this._getFinalPath(cleanPath);
       const data = await (method == "PUT" ? put : post)(_this.fetch, `${_this.url}/object/${_path}`, body, _objectSpread22({ headers }, (options === null || options === void 0 ? void 0 : options.duplex) ? { duplex: options.duplex } : {}));
       return {
@@ -34063,8 +34063,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Upload file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async upload(path5, fileBody, fileOptions) {
-    return this.uploadOrUpdate("POST", path5, fileBody, fileOptions);
+  async upload(path6, fileBody, fileOptions) {
+    return this.uploadOrUpdate("POST", path6, fileBody, fileOptions);
   }
   /**
   * Upload a file with a token generated from `createSignedUploadUrl`.
@@ -34104,9 +34104,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async uploadToSignedUrl(path5, token, fileBody, fileOptions) {
+  async uploadToSignedUrl(path6, token, fileBody, fileOptions) {
     var _this3 = this;
-    const cleanPath = _this3._removeEmptyFolders(path5);
+    const cleanPath = _this3._removeEmptyFolders(path6);
     const _path = _this3._getFinalPath(cleanPath);
     const url2 = new URL(_this3.url + `/object/upload/sign/${_path}`);
     url2.searchParams.set("token", token);
@@ -34175,10 +34175,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `insert`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUploadUrl(path5, options) {
+  async createSignedUploadUrl(path6, options) {
     var _this4 = this;
     return _this4.handleOperation(async () => {
-      let _path = _this4._getFinalPath(path5);
+      let _path = _this4._getFinalPath(path6);
       const headers = _objectSpread22({}, _this4.headers);
       if (options === null || options === void 0 ? void 0 : options.upsert) headers["x-upsert"] = "true";
       const data = await post(_this4.fetch, `${_this4.url}/object/upload/sign/${_path}`, {}, { headers });
@@ -34187,7 +34187,7 @@ var StorageFileApi = class extends BaseApiClient {
       if (!token) throw new StorageError("No token returned by API");
       return {
         signedUrl: url2.toString(),
-        path: path5,
+        path: path6,
         token
       };
     });
@@ -34247,8 +34247,8 @@ var StorageFileApi = class extends BaseApiClient {
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   * - For React Native, using either `Blob`, `File` or `FormData` does not work as intended. Update file using `ArrayBuffer` from base64 file data instead, see example below.
   */
-  async update(path5, fileBody, fileOptions) {
-    return this.uploadOrUpdate("PUT", path5, fileBody, fileOptions);
+  async update(path6, fileBody, fileOptions) {
+    return this.uploadOrUpdate("PUT", path6, fileBody, fileOptions);
   }
   /**
   * Moves an existing file to a new path in the same bucket.
@@ -34399,10 +34399,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async createSignedUrl(path5, expiresIn, options) {
+  async createSignedUrl(path6, expiresIn, options) {
     var _this8 = this;
     return _this8.handleOperation(async () => {
-      let _path = _this8._getFinalPath(path5);
+      let _path = _this8._getFinalPath(path6);
       const hasTransform = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0;
       let data = await post(_this8.fetch, `${_this8.url}/object/sign/${_path}`, _objectSpread22({ expiresIn }, hasTransform ? { transform: options.transform } : {}), { headers: _this8.headers });
       const query = new URLSearchParams();
@@ -34538,13 +34538,13 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  download(path5, options, parameters) {
+  download(path6, options, parameters) {
     const renderPath = typeof (options === null || options === void 0 ? void 0 : options.transform) === "object" && options.transform !== null && Object.keys(options.transform).length > 0 ? "render/image/authenticated" : "object";
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
     if ((options === null || options === void 0 ? void 0 : options.cacheNonce) != null) query.set("cacheNonce", String(options.cacheNonce));
     const queryString = query.toString();
-    const _path = this._getFinalPath(path5);
+    const _path = this._getFinalPath(path6);
     const downloadFn = () => get(this.fetch, `${this.url}/${renderPath}/${_path}${queryString ? `?${queryString}` : ""}`, {
       headers: this.headers,
       noResolveJson: true
@@ -34575,9 +34575,9 @@ var StorageFileApi = class extends BaseApiClient {
   * }
   * ```
   */
-  async info(path5) {
+  async info(path6) {
     var _this10 = this;
-    const _path = _this10._getFinalPath(path5);
+    const _path = _this10._getFinalPath(path6);
     return _this10.handleOperation(async () => {
       return recursiveToCamel(await get(_this10.fetch, `${_this10.url}/object/info/${_path}`, { headers: _this10.headers }));
     });
@@ -34598,9 +34598,9 @@ var StorageFileApi = class extends BaseApiClient {
   *   .exists('folder/avatar1.png')
   * ```
   */
-  async exists(path5) {
+  async exists(path6) {
     var _this11 = this;
-    const _path = _this11._getFinalPath(path5);
+    const _path = _this11._getFinalPath(path6);
     try {
       await head(_this11.fetch, `${_this11.url}/object/${_path}`, { headers: _this11.headers });
       return {
@@ -34679,8 +34679,8 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: none
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  getPublicUrl(path5, options) {
-    const _path = this._getFinalPath(path5);
+  getPublicUrl(path6, options) {
+    const _path = this._getFinalPath(path6);
     const query = new URLSearchParams();
     if (options === null || options === void 0 ? void 0 : options.download) query.set("download", options.download === true ? "" : options.download);
     if (options === null || options === void 0 ? void 0 : options.transform) this.applyTransformOptsToQuery(query, options.transform);
@@ -34819,10 +34819,10 @@ var StorageFileApi = class extends BaseApiClient {
   *   - `objects` table permissions: `select`
   * - Refer to the [Storage guide](/docs/guides/storage/security/access-control) on how access control works
   */
-  async list(path5, options, parameters) {
+  async list(path6, options, parameters) {
     var _this13 = this;
     return _this13.handleOperation(async () => {
-      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path5 || "" });
+      const body = _objectSpread22(_objectSpread22(_objectSpread22({}, DEFAULT_SEARCH_OPTIONS), options), {}, { prefix: path6 || "" });
       return await post(_this13.fetch, `${_this13.url}/object/list/${_this13.bucketId}`, body, { headers: _this13.headers }, parameters);
     });
   }
@@ -34887,11 +34887,11 @@ var StorageFileApi = class extends BaseApiClient {
     if (typeof Buffer !== "undefined") return Buffer.from(data).toString("base64");
     return btoa(data);
   }
-  _getFinalPath(path5) {
-    return `${this.bucketId}/${path5.replace(/^\/+/, "")}`;
+  _getFinalPath(path6) {
+    return `${this.bucketId}/${path6.replace(/^\/+/, "")}`;
   }
-  _removeEmptyFolders(path5) {
-    return path5.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
+  _removeEmptyFolders(path6) {
+    return path6.replace(/^\/|\/$/g, "").replace(/\/+/g, "/");
   }
   /** Modifies the `query`, appending values the from `transform` */
   applyTransformOptsToQuery(query, transform2) {
@@ -42664,7 +42664,14 @@ var softwareCapacityObservationSummarySchema = external_exports.object({
   account_alias: external_exports.string().nullable()
 });
 var softwareRequestCreateInputSchema = external_exports.object({
-  software_project_id: uuid10,
+  // DER-1310: the project the request opens against. Either identifier works —
+  // the raw id (still fully supported) or `project`, the project's slug or name,
+  // resolved server-side to the tenant's active project. The command layer (not
+  // this schema) enforces that exactly one resolves, with an actionable error
+  // when neither is given or neither matches — keeping this shape a plain
+  // `z.object` so JSON-schema/CLI-flag projection stays simple (no `.refine`).
+  software_project_id: uuid10.optional(),
+  project: external_exports.string().trim().min(1).max(200).optional(),
   // Untrusted display text (ADR-0018 §5) — bounded, never treated as an instruction.
   title: external_exports.string().trim().min(1).max(500),
   source_channel: softwareSourceChannelSchema.optional(),
@@ -45125,7 +45132,7 @@ External connectors are being rolled out provider by provider, conservatively (r
     order: 48,
     title: "CLI and MCP installation guide",
     summary: "Install the public CLI, register remote token-backed MCP clients, and find the full command and tool catalog.",
-    version: "2026-07-04.21",
+    version: "2026-07-05.1",
     public: true,
     audiences: ["human", "cli", "mcp", "in_app_agent"],
     stages: ["company_setup", "staffing"],
@@ -45604,7 +45611,7 @@ The signed-in app exposes the same Skill command surface at **Skills**, linked f
 | \`{{cli}} deliverable list|get|create|attach\` | \`deliverable.list\`, \`deliverable.get\`, \`deliverable.create\`, \`deliverable.attach\` | List, get, create, or attach agent deliverables for a seat. Deliverables are durable work outputs visible across UI, CLI, and MCP. | Tenant (list/get), Seat (create/attach) | \`{{cli}} deliverable list --seat-id <id> --json\`; \`{{cli}} deliverable create --title "Brief" --kind brief\` |
 | \`{{cli}} graph show\` | \`graph.get\` | Print a table view of the Responsibility Graph with explicit \`seat_id\` and \`parent_seat_id\` columns. | Tenant | \`{{cli}} graph show\` |
 | \`{{cli}} seat list|get|create|rename|reparent|decommission\` | \`graph.get\`, \`seat.get\`, \`seat.create\`, \`seat.rename\`, \`seat.reparent\`, \`seat.decommission\`, \`seat.decommission_preview\` | Work with seats as first-class CLI primitives. \`seat decommission --dry-run\` previews affected occupancies, agents, Charters, tokens, credentials, work orders, and schedules before the human-gated teardown. | Tenant / Seat for targeted mutations | \`{{cli}} seat list\`; \`{{cli}} seat decommission --seat-id <id> --dry-run\` |
-| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. Pause halts new runner claims at the next task checkpoint, cancel drives terminal canceled, and resume requeues from the last completed task checkpoint. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --software-project-id <id> --title "Add invoice export"\`; \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
+| \`{{cli}} forge project-create|project-list|request-create|request-list|request-show|request-pause|request-cancel|request-resume\` | \`software_factory.project.create\`, \`software_factory.project.list\`, \`software_factory.request.create\`, \`software_factory.request.list\`, \`software_factory.request.show\`, \`software_factory.request.pause\`, \`software_factory.request.cancel\`, \`software_factory.request.resume\` | Create/list Forge projects, open/read governed Forge build requests, and control request lifecycle. Project creation plus pause/cancel/resume are tenant-admin, entitlement-gated, and human-gated; reads and request creation require the Forge add-on. Pause halts new runner claims at the next task checkpoint, cancel drives terminal canceled, and resume requeues from the last completed task checkpoint. | Tenant / Tenant-admin for create and lifecycle controls | \`{{cli}} forge project-create --name "Leiluna app" --base-branch main\`; \`{{cli}} forge request-create --project <slug-or-name> --title "Add invoice export"\` (accepts \`--software-project-id <id>\` instead of \`--project\` too); \`{{cli}} forge request-pause --build-request-id <id> --reason "Operator hold"\` |
 
 Skills wrapper help:
 
@@ -45845,7 +45852,7 @@ Several rows here are seat-operating commands (\`task.create\`, the \`signal.*\`
 | \`rost_revoke_skill_from_seat\` | \`skill.revoke_from_seat\` | Human-gated revocation that stops future Skill use without deleting historical activations. | Tenant-admin | Call with \`{"assignment_id":"<assignment-id>"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_list_model_catalog\` | \`model.catalog\` | List guided model tiers \u2014 recommendations, token prices, cost bands, best-fit work, and model ids for \`--model\`. | Tenant | Call with \`{}\`. |
 | \`rost_create_a_forge_project\` | \`software_factory.project.create\` | Create an active Forge software project before binding repositories or opening build requests. Tenant-admin, human-gated, and entitlement-gated. | Tenant-admin | Call with \`{"name":"Leiluna app","slug":"leiluna-app","base_branch":"main"}\`; non-interactive callers receive a confirmation handoff. |
-| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"software_project_id":"<project-id>","title":"Add invoice export"}\`. |
+| \`rost_create_a_forge_build_request\` | \`software_factory.request.create\` | Open a governed Forge build request against a connected software project; records the request plus its initial intake phase run. Requires the Forge add-on; the title is untrusted display text. | Tenant | Call with \`{"project":"<slug-or-name>","title":"Add invoice export"}\` (or \`{"software_project_id":"<project-id>", ...}\`). |
 | \`rost_pause_a_forge_build_request\` | \`software_factory.request.pause\` | Pause an in-flight Forge build request. New runner claims stop immediately; running work halts at the next task checkpoint. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Operator hold"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_cancel_a_forge_build_request\` | \`software_factory.request.cancel\` | Cancel a Forge build request and expire active runner work orders. This is terminal; use pause for reversible holds. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Out of scope"}\`; non-interactive callers receive a confirmation handoff. |
 | \`rost_resume_a_forge_build_request\` | \`software_factory.request.resume\` | Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated. | Tenant-admin | Call with \`{"build_request_id":"<request-id>","reason":"Budget raised"}\`; non-interactive callers receive a confirmation handoff. |
@@ -49089,7 +49096,7 @@ var COMMAND_MANIFEST = [
   { "id": "software_factory.project.list", "namespace": "software_factory", "action": "project.list", "title": "List Forge projects", "description": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only and entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [], "hasComplexInput": false, "help": "List active Forge software projects so a tenant can choose a project for build requests, GitHub repository bindings, and config. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.answer_clarification", "namespace": "software_factory", "action": "request.answer_clarification", "title": "Answer Forge plan clarifications", "description": "Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review. Answers append to the versioned planning artifact; this never widens authority or automation mode.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "mark_ready_for_plan_review", "flag": "mark-ready-for-plan-review", "type": "boolean", "required": false }], "hasComplexInput": true, "help": "Write structured human answers to a draft plan's clarifying questions and optionally mark it ready for plan review. Never widens authority or automation mode." },
   { "id": "software_factory.request.cancel", "namespace": "software_factory", "action": "request.cancel", "title": "Cancel a Forge build request", "description": "Cancel a Forge build request and expire active runner work orders. This is terminal; use pause for reversible holds. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Cancel a Forge build request, expire unstarted runner work, and terminalize active runner work. Terminal, tenant-admin, and human-gated." },
-  { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": true }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
+  { "id": "software_factory.request.create", "namespace": "software_factory", "action": "request.create", "title": "Create a Forge build request", "description": "Open a governed Forge build request against a connected software project. Records the request plus its initial intake phase run. Entitlement-gated (Forge add-on); the title is untrusted display text, never an instruction.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "software_project_id", "flag": "software-project-id", "type": "string", "required": false }, { "name": "project", "flag": "project", "type": "string", "required": false }, { "name": "title", "flag": "title", "type": "string", "required": true }, { "name": "source_channel", "flag": "source-channel", "type": "enum", "required": false, "enumValues": ["ui", "cli", "github_issue", "linear", "api"] }, { "name": "source_ref", "flag": "source-ref", "type": "string", "required": false }], "hasComplexInput": true, "help": "Open a governed Forge build request against a connected software project; the title is untrusted display text. Requires the Forge add-on." },
   { "id": "software_factory.request.list", "namespace": "software_factory", "action": "request.list", "title": "List Forge build requests", "description": "The Forge control-room board: the tenant's build requests with status, current phase, and risk/automation mode. Read-only, entitlement-gated.", "requiredScope": "tenant", "confirmation": "none", "exposeOverMcp": true, "fields": [{ "name": "limit", "flag": "limit", "type": "integer", "required": false }], "hasComplexInput": false, "help": "List Forge build requests (the control-room board) with status, current phase, and risk. Read-only; requires the Forge add-on." },
   { "id": "software_factory.request.pause", "namespace": "software_factory", "action": "request.pause", "title": "Pause a Forge build request", "description": "Pause an in-flight Forge build request. New runner claims stop immediately; any running task halts at the next task checkpoint before resume. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": false, "help": "Pause an in-flight Forge build request so no new runner work starts; running work stops at the next task checkpoint. Tenant-admin and human-gated." },
   { "id": "software_factory.request.resume", "namespace": "software_factory", "action": "request.resume", "title": "Resume a Forge build request", "description": "Resume a paused or human-blocked Forge build request from the last completed task checkpoint and requeue the current phase. Human-gated and entitlement-gated.", "requiredScope": "tenant_admin", "confirmation": "human_required", "exposeOverMcp": true, "fields": [{ "name": "build_request_id", "flag": "build-request-id", "type": "string", "required": true }, { "name": "reason", "flag": "reason", "type": "string", "required": false }], "hasComplexInput": true, "help": "Resume a paused or blocked Forge build request from its last completed task checkpoint after human review. Tenant-admin and human-gated." },
@@ -49319,9 +49326,9 @@ function coerceScalar(field3, raw) {
   }
 }
 function rawValueForField(entry, field3, parsed, aliasFlags) {
-  const canonical = parsed.values.get(field3.flag);
-  if (canonical !== void 0) {
-    return canonical;
+  const canonical2 = parsed.values.get(field3.flag);
+  if (canonical2 !== void 0) {
+    return canonical2;
   }
   for (const [aliasFlag, targetField] of aliasFlags) {
     if (targetField === field3.name) {
@@ -51655,11 +51662,247 @@ function parseSemver2(value) {
 // src/runner-serve.ts
 import { execFile as execFileCallback3, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmod, mkdir as mkdir2, readFile as readFile4, rename, rm as rm2, writeFile as writeFile2 } from "node:fs/promises";
-import { cpus, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
-import path3 from "node:path";
+import { chmod, mkdir as mkdir2, readFile as readFile4, rename, rm as rm3, writeFile as writeFile2 } from "node:fs/promises";
+import { cpus, homedir as homedir2, hostname as hostname3, platform, totalmem, tmpdir } from "node:os";
+import path4 from "node:path";
 import { setTimeout as sleep2 } from "node:timers/promises";
 import { promisify as promisify3 } from "node:util";
+
+// src/runner-sandbox.ts
+import { existsSync as existsSync2, realpathSync } from "node:fs";
+import { readdir, rm as rm2, stat as stat2 } from "node:fs/promises";
+import path3 from "node:path";
+var SANDBOX_EXEC_PATH = "/usr/bin/sandbox-exec";
+var RUNNER_TEMP_PREFIXES = [
+  "rost-runner-mcp-",
+  "rost-runner-sandbox-",
+  "rost-runner-askpass-"
+];
+var SENSITIVE_READ_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/gcloud",
+  ".config/gh",
+  ".kube",
+  ".docker",
+  ".npmrc"
+];
+var SENSITIVE_READ_LITERALS = [".netrc"];
+var SENSITIVE_WRITE_SUBPATHS = [
+  ".ssh",
+  ".aws",
+  ".gnupg",
+  ".config/git",
+  "bin",
+  "Library/LaunchAgents"
+];
+var SENSITIVE_WRITE_LITERALS = [
+  ".gitconfig",
+  ".zshrc",
+  ".zprofile",
+  ".zshenv",
+  ".zlogin",
+  ".bashrc",
+  ".bash_profile",
+  ".bash_login",
+  ".profile"
+];
+function parseSandboxMode(value) {
+  const normalized = (value ?? "auto").trim().toLowerCase();
+  if (normalized === "off" || normalized === "strict" || normalized === "auto" || normalized === "") {
+    return normalized === "" ? "auto" : normalized;
+  }
+  return "auto";
+}
+function parseSandboxNetwork(value) {
+  const normalized = (value ?? "").trim().toLowerCase();
+  if (normalized === "" || normalized === "allow") {
+    return { allowNetwork: true, unrecognized: null };
+  }
+  if (normalized === "deny") {
+    return { allowNetwork: false, unrecognized: null };
+  }
+  return { allowNetwork: true, unrecognized: value ?? "" };
+}
+function sbplString(value) {
+  return `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+}
+function subpath(value) {
+  return `(subpath ${sbplString(value)})`;
+}
+function literal2(value) {
+  return `(literal ${sbplString(value)})`;
+}
+var STRICT_SYSTEM_READ_SUBPATHS = [
+  "/usr",
+  "/bin",
+  "/sbin",
+  "/System",
+  "/Library",
+  "/private/etc",
+  "/private/var/db",
+  "/dev",
+  "/opt",
+  "/nix"
+];
+function buildSeatbeltProfile(input) {
+  const home = input.homeDir.replace(/\/+$/, "");
+  const lines = ["(version 1)"];
+  const denyReadBaseSubpaths = input.denyReadPaths.filter((p) => p.endsWith("/")).map((p) => subpath(p.replace(/\/+$/, "")));
+  const denyReadLiterals = input.denyReadPaths.filter((p) => !p.endsWith("/")).map(literal2);
+  const credentialReadDenies = [
+    ...SENSITIVE_READ_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_READ_LITERALS.map((rel) => literal2(`${home}/${rel}`))
+  ];
+  if (input.strict) {
+    lines.push("(deny default)");
+    lines.push("(allow process*)");
+    lines.push("(allow sysctl-read)");
+    lines.push("(allow mach-lookup)");
+    lines.push("(allow iokit-open)");
+    lines.push("(allow system-socket)");
+    lines.push("(allow signal (target self))");
+    lines.push("(allow file-read-metadata)");
+    const strictReads = [
+      ...STRICT_SYSTEM_READ_SUBPATHS.map(subpath),
+      subpath(`${home}/.claude`),
+      subpath(`${home}/.codex`),
+      subpath(input.tmpDir)
+    ];
+    lines.push(`(allow file-read* ${strictReads.join(" ")})`);
+  } else {
+    lines.push("(allow default)");
+  }
+  lines.push("(deny appleevent-send)");
+  if (denyReadBaseSubpaths.length > 0) {
+    lines.push(`(deny file-read* ${denyReadBaseSubpaths.join(" ")})`);
+  }
+  const workspaceReads = [subpath(input.workspaceDir), ...input.allowWritePaths.map(subpath)];
+  lines.push(`(allow file-read* ${workspaceReads.join(" ")})`);
+  lines.push("(deny file-write*)");
+  const allowWrites = [
+    subpath(input.workspaceDir),
+    subpath(input.tmpDir),
+    subpath(`${home}/.claude`),
+    subpath(`${home}/.codex`),
+    ...input.allowWritePaths.map(subpath),
+    subpath("/dev/fd"),
+    literal2("/dev/null"),
+    literal2("/dev/stdout"),
+    literal2("/dev/stderr"),
+    literal2("/dev/tty"),
+    literal2("/dev/dtracehelper")
+  ];
+  lines.push(`(allow file-write* ${allowWrites.join(" ")})`);
+  lines.push(`(deny file-read* ${[...credentialReadDenies, ...denyReadLiterals].join(" ")})`);
+  const denyWrites = [
+    ...SENSITIVE_WRITE_SUBPATHS.map((rel) => subpath(`${home}/${rel}`)),
+    ...SENSITIVE_WRITE_LITERALS.map((rel) => literal2(`${home}/${rel}`))
+  ];
+  lines.push(`(deny file-write* ${denyWrites.join(" ")})`);
+  lines.push('(deny mach-lookup (global-name "com.apple.coreservices.appleevents"))');
+  if (!input.allowNetwork) {
+    lines.push("(deny network*)");
+  } else if (input.strict) {
+    lines.push("(allow network*)");
+  }
+  return `${lines.join("\n")}
+`;
+}
+function canonical(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+function canonicalFile(p) {
+  return path3.join(canonical(path3.dirname(p)), path3.basename(p));
+}
+function isSandboxExecAvailable() {
+  try {
+    return existsSync2(SANDBOX_EXEC_PATH);
+  } catch {
+    return false;
+  }
+}
+function resolveSandboxSpec(options) {
+  if (options.mode === "off") {
+    return { kind: "none", reason: "RUNNER_SANDBOX=off (loosened fallback - OS confinement disabled)" };
+  }
+  if (options.platform !== "darwin") {
+    return { kind: "none", reason: `no OS sandbox on ${options.platform} (seatbelt is macOS-only; Linux confinement is a follow-up)` };
+  }
+  const available = options.sandboxExecAvailable ?? isSandboxExecAvailable();
+  if (!available) {
+    return { kind: "none", reason: `sandbox-exec not found at ${SANDBOX_EXEC_PATH}` };
+  }
+  const workspaceDir = canonical(options.workspaceDir);
+  const tmpDir = canonical(options.tmpDir);
+  const homeDir = canonical(options.homeDir);
+  const allowNetwork = options.allowNetwork ?? true;
+  const denyReadPaths = [canonicalFile(options.stateFile)];
+  if (options.runnerBaseDir) {
+    denyReadPaths.push(`${canonical(options.runnerBaseDir).replace(/\/+$/, "")}/`);
+  }
+  const profile = buildSeatbeltProfile({
+    workspaceDir,
+    tmpDir,
+    homeDir,
+    denyReadPaths,
+    allowWritePaths: (options.allowWritePaths ?? []).map(canonical),
+    allowNetwork,
+    strict: options.mode === "strict"
+  });
+  return {
+    kind: "seatbelt",
+    reason: options.mode === "strict" ? "seatbelt (strict: deny-default reads + write confinement)" : "seatbelt (guard: deny sensitive reads/writes)",
+    profile,
+    allowNetwork
+  };
+}
+function wrapCommandWithSandbox(spec, command, args, profilePath) {
+  if (spec.kind === "none" || profilePath === null) {
+    return { command, args, profilePath: null };
+  }
+  return {
+    command: SANDBOX_EXEC_PATH,
+    args: ["-f", profilePath, command, ...args],
+    profilePath
+  };
+}
+async function sweepStaleRunnerTempFiles(dir, options = {}) {
+  const maxAgeMs = options.maxAgeMs ?? 60 * 60 * 1e3;
+  const now = options.now ?? Date.now();
+  let entries;
+  try {
+    entries = await readdir(dir);
+  } catch {
+    return [];
+  }
+  const removed = [];
+  await Promise.all(
+    entries.map(async (name) => {
+      if (!RUNNER_TEMP_PREFIXES.some((prefix) => name.startsWith(prefix))) {
+        return;
+      }
+      const full = path3.join(dir, name);
+      try {
+        const info = await stat2(full);
+        if (now - info.mtimeMs < maxAgeMs) {
+          return;
+        }
+        await rm2(full, { force: true });
+        removed.push(name);
+      } catch {
+      }
+    })
+  );
+  return removed;
+}
+
+// src/runner-serve.ts
 var execFile3 = promisify3(execFileCallback3);
 var RUNNER_WORK_ORDER_TOOLS = [
   "mcp__rost__rost_get_context",
@@ -51685,6 +51928,20 @@ ${usage()}
   }
   options.io.stdout.write(`runner serve: ${options.appUrl} name=${config2.name} execute=${config2.execute}
 `);
+  options.io.stdout.write(`runner sandbox: ${config2.sandbox.kind} - ${config2.sandbox.reason}
+`);
+  if (config2.sandboxNetworkWarning) {
+    options.io.stderr.write(`warning: ${config2.sandboxNetworkWarning}
+`);
+  }
+  try {
+    const swept = await sweepStaleRunnerTempFiles(tmpdir());
+    if (swept.length > 0) {
+      options.io.stdout.write(`swept ${swept.length} stale runner temp file(s)
+`);
+    }
+  } catch {
+  }
   let state;
   try {
     state = await pairIfNeeded(options.client ?? null, fetchImpl, options.appUrl, config2, options.io);
@@ -51770,7 +52027,7 @@ function detectTelemetry(capabilities, env, activeSessions) {
 }
 function parseServeArgs(args, appUrl2, env) {
   let name = env.RUNNER_NAME ?? `headless-${hostname3()}`;
-  let stateFile = env.RUNNER_STATE_FILE ?? path3.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
+  let stateFile = env.RUNNER_STATE_FILE ?? path4.join(tmpdir(), `rost-runner-${createHash("sha1").update(appUrl2).digest("hex").slice(0, 8)}.json`);
   let heartbeatMs = Number(env.RUNNER_HEARTBEAT_MS ?? 3e4);
   let interactiveClaimMs = Number(env.RUNNER_INTERACTIVE_CLAIM_MS ?? 1e3);
   let execute2 = env.RUNNER_EXECUTE === "1";
@@ -51812,7 +52069,29 @@ function parseServeArgs(args, appUrl2, env) {
     throw new Error("--interactive-claim-ms must be an integer >= 250.");
   }
   interactiveClaimMs = Math.min(interactiveClaimMs, heartbeatMs);
-  return { name, stateFile, heartbeatMs, interactiveClaimMs, execute: execute2, once, runtime, ...userCode ? { userCode } : {} };
+  const network = parseSandboxNetwork(env.RUNNER_SANDBOX_NETWORK);
+  const sandbox = resolveSandboxSpec({
+    mode: parseSandboxMode(env.RUNNER_SANDBOX),
+    platform: process.platform,
+    workspaceDir: tmpdir(),
+    tmpDir: tmpdir(),
+    homeDir: homedir2(),
+    stateFile,
+    runnerBaseDir: path4.join(homedir2(), ".rost"),
+    allowNetwork: network.allowNetwork
+  });
+  return {
+    name,
+    stateFile,
+    heartbeatMs,
+    interactiveClaimMs,
+    execute: execute2,
+    once,
+    runtime,
+    sandbox,
+    ...network.unrecognized !== null ? { sandboxNetworkWarning: `RUNNER_SANDBOX_NETWORK='${network.unrecognized}' not recognized (use allow|deny); defaulting to allow egress.` } : {},
+    ...userCode ? { userCode } : {}
+  };
 }
 function parseRuntime(value) {
   if (value === "auto" || value === "claude" || value === "codex") {
@@ -51932,7 +52211,7 @@ function isRuntimeSessionMap(value) {
   });
 }
 async function saveState(filePath, state) {
-  await mkdir2(path3.dirname(filePath), { recursive: true, mode: 448 });
+  await mkdir2(path4.dirname(filePath), { recursive: true, mode: 448 });
   const tempPath = `${filePath}.${process.pid}.${createHash("sha1").update(`${Date.now()}:${Math.random()}`).digest("hex").slice(0, 8)}.tmp`;
   try {
     await writeFile2(tempPath, `${JSON.stringify(state)}
@@ -51940,7 +52219,7 @@ async function saveState(filePath, state) {
     await chmod(tempPath, 384);
     await rename(tempPath, filePath);
   } catch (error51) {
-    await rm2(tempPath, { force: true });
+    await rm3(tempPath, { force: true });
     throw error51;
   }
 }
@@ -52026,7 +52305,7 @@ async function executeClaimedUnit(fetchImpl, appUrl2, state, config2, io, runtim
     throw new Error(`${claimedUnitLabel(input.kind)} start failed ${started.status}: ${redactForLog(JSON.stringify(started.json))}`);
   }
   const turnRuntime = runtimeForClaimedUnit(input.item, runtime, input.kind);
-  const result = turnRuntime ? await runLocalTurn(appUrl2, input.item, turnRuntime, input.kind, state) : {
+  const result = turnRuntime ? await runLocalTurn(appUrl2, input.item, turnRuntime, input.kind, state, config2.sandbox) : {
     ok: false,
     summary: `Runner runtime ${runtime} cannot execute requested ${String(input.item.brain ?? "unknown")} turn.`
   };
@@ -52066,14 +52345,14 @@ function runtimeForClaimedUnit(item, fallback, kind) {
   }
   return fallback === "claude" ? "claude" : null;
 }
-function runLocalTurn(appUrl2, workOrder, runtime, kind, state) {
-  return runtime === "codex" ? runCodexTurn(appUrl2, workOrder, kind) : runClaudeTurn(appUrl2, workOrder, kind, state);
+function runLocalTurn(appUrl2, workOrder, runtime, kind, state, sandbox) {
+  return runtime === "codex" ? runCodexTurn(appUrl2, workOrder, kind, sandbox) : runClaudeTurn(appUrl2, workOrder, kind, state, sandbox);
 }
-function runClaudeTurn(appUrl2, workOrder, kind, state) {
-  return spawnRunnerTurn(appUrl2, workOrder, "claude", kind, state);
+function runClaudeTurn(appUrl2, workOrder, kind, state, sandbox) {
+  return spawnRunnerTurn(appUrl2, workOrder, "claude", kind, sandbox, state);
 }
-function runCodexTurn(appUrl2, workOrder, kind) {
-  return spawnRunnerTurn(appUrl2, workOrder, "codex", kind);
+function runCodexTurn(appUrl2, workOrder, kind, sandbox) {
+  return spawnRunnerTurn(appUrl2, workOrder, "codex", kind, sandbox);
 }
 function buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId) {
   if (runtime === "codex") {
@@ -52098,12 +52377,12 @@ function buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId) {
     ]
   };
 }
-async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
+async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, sandbox, state) {
   const mcp = typeof workOrder.mcp === "object" && workOrder.mcp !== null ? workOrder.mcp : {};
   const token = typeof mcp.token === "string" ? mcp.token : "";
   const url2 = typeof mcp.url === "string" ? `${appUrl2.replace(/\/+$/, "")}${mcp.url}` : `${appUrl2.replace(/\/+$/, "")}/mcp`;
   const mcpConfig = JSON.stringify({ mcpServers: { rost: { type: "http", url: url2, headers: { Authorization: `Bearer ${token}` } } } });
-  const configPath = path3.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
+  const configPath = path4.join(tmpdir(), `rost-runner-mcp-${createHash("sha256").update(`${url2}:${Date.now()}:${Math.random()}`).digest("hex").slice(0, 16)}.json`);
   const context = {
     work_order_id: kind === "work_order" ? workOrder.id : null,
     turn_execution_id: kind === "turn_execution" ? workOrder.id : null,
@@ -52133,7 +52412,17 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
 `, { mode: 384 });
   await chmod(configPath, 384);
   const resumeSessionId = runtime === "claude" ? getClaudeResumeSessionId(state, workOrder) : void 0;
-  const { command, args } = buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId);
+  const built = buildTurnCommand(runtime, prompt, configPath, kind, resumeSessionId);
+  let sandboxProfilePath = null;
+  if (sandbox.kind === "seatbelt") {
+    sandboxProfilePath = path4.join(
+      tmpdir(),
+      `rost-runner-sandbox-${createHash("sha256").update(`${configPath}:${Math.random()}`).digest("hex").slice(0, 16)}.sb`
+    );
+    await writeFile2(sandboxProfilePath, sandbox.profile, { mode: 384 });
+    await chmod(sandboxProfilePath, 384);
+  }
+  const { command, args } = wrapCommandWithSandbox(sandbox, built.command, built.args, sandboxProfilePath);
   const expectSessionEnvelope = runtime === "claude" && kind === "turn_execution";
   return new Promise((resolve2) => {
     let settled = false;
@@ -52142,7 +52431,10 @@ async function spawnRunnerTurn(appUrl2, workOrder, runtime, kind, state) {
         return;
       }
       settled = true;
-      void rm2(configPath, { force: true });
+      void rm3(configPath, { force: true });
+      if (sandboxProfilePath) {
+        void rm3(sandboxProfilePath, { force: true });
+      }
       resolve2(resumeSessionId ? { ...result, resumedFromSessionId: resumeSessionId } : result);
     };
     const child = spawn(command, args, {
@@ -52275,10 +52567,10 @@ function usage() {
 
 // src/runner-service.ts
 import { execFile as execFileCallback4 } from "node:child_process";
-import { realpathSync } from "node:fs";
-import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm3, writeFile as writeFile3 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import path4 from "node:path";
+import { realpathSync as realpathSync2 } from "node:fs";
+import { access as access2, mkdir as mkdir3, readFile as readFile5, rm as rm4, writeFile as writeFile3 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path5 from "node:path";
 import { promisify as promisify4 } from "node:util";
 var execFile4 = promisify4(execFileCallback4);
 var SERVICE_VERBS = ["install-service", "start", "stop", "restart", "status", "logs", "uninstall"];
@@ -52295,9 +52587,9 @@ function isRunnerServiceInvocation(args) {
 function runnerServicePaths(homeDir, runnerName) {
   const safeName = safeRunnerName(runnerName);
   return {
-    launchAgentPath: path4.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
-    stateFile: path4.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
-    logDir: path4.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
+    launchAgentPath: path5.join(homeDir, "Library", "LaunchAgents", `${serviceLabel(safeName)}.plist`),
+    stateFile: path5.join(homeDir, "Library", "Application Support", cliBrand.name, `runner-${safeName}.json`),
+    logDir: path5.join(homeDir, "Library", "Logs", cliBrand.name, "runner", safeName)
   };
 }
 function renderLaunchdPlist(config2) {
@@ -52337,9 +52629,9 @@ ${programArgsXml}
   <key>RunAtLoad</key>
   <true/>
   <key>StandardOutPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stdout.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stdout.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${escapePlist(path4.join(config2.logDir, "stderr.log"))}</string>
+  <string>${escapePlist(path5.join(config2.logDir, "stderr.log"))}</string>
 </dict>
 </plist>
 `;
@@ -52374,7 +52666,7 @@ ${serviceUsage()}
     userCode: parsed.userCode,
     nodePath: options.nodePath ?? resolveNodePath(),
     binPath: options.binPath ?? resolveBinPath(),
-    homeDir: options.homeDir ?? homedir2(),
+    homeDir: options.homeDir ?? homedir3(),
     platform: options.platform ?? process.platform,
     exec: options.exec ?? defaultExec,
     uid: options.uid ?? (process.getuid ? process.getuid() : 0)
@@ -52406,8 +52698,8 @@ async function installService(options) {
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
   await mkdir3(paths.logDir, { recursive: true });
-  await mkdir3(path4.dirname(paths.stateFile), { recursive: true });
-  await mkdir3(path4.dirname(paths.launchAgentPath), { recursive: true });
+  await mkdir3(path5.dirname(paths.stateFile), { recursive: true });
+  await mkdir3(path5.dirname(paths.launchAgentPath), { recursive: true });
   if (options.userCode !== void 0) {
     const paired = await pairRunnerOnce(options, safeName, paths.stateFile, options.userCode);
     if (!paired) {
@@ -52585,8 +52877,8 @@ async function logsService(options) {
   const safeName = safeRunnerName(options.runnerName);
   const paths = runnerServicePaths(options.homeDir, safeName);
   const label = serviceLabel(safeName);
-  const stdoutLog = path4.join(paths.logDir, "stdout.log");
-  const stderrLog = path4.join(paths.logDir, "stderr.log");
+  const stdoutLog = path5.join(paths.logDir, "stdout.log");
+  const stderrLog = path5.join(paths.logDir, "stderr.log");
   options.io.stdout.write(
     `${[
       `runner service logs for ${label}:`,
@@ -52617,7 +52909,7 @@ async function uninstallService(options) {
   await bootoutQuietly(options.exec, options.uid, paths.launchAgentPath);
   let removed = false;
   try {
-    await rm3(paths.launchAgentPath, { force: true });
+    await rm4(paths.launchAgentPath, { force: true });
     removed = true;
   } catch (error51) {
     options.io.stderr.write(
@@ -52761,11 +53053,11 @@ function resolveNodePath() {
 }
 function buildServicePath(nodePath, homeDir) {
   const entries = [
-    path4.dirname(nodePath),
+    path5.dirname(nodePath),
     "/opt/homebrew/bin",
     "/usr/local/bin",
-    path4.join(homeDir, ".local", "bin"),
-    path4.join(homeDir, "bin"),
+    path5.join(homeDir, ".local", "bin"),
+    path5.join(homeDir, "bin"),
     "/usr/bin",
     "/bin",
     "/usr/sbin",
@@ -52810,7 +53102,7 @@ function resolveBinPath() {
     return cliBrand.binName;
   }
   try {
-    return realpathSync(entry);
+    return realpathSync2(entry);
   } catch {
     return entry;
   }
@@ -53473,7 +53765,7 @@ function isCliEntrypoint(moduleUrl, argvPath) {
     return false;
   }
   try {
-    return realpathSync2(fileURLToPath3(moduleUrl)) === realpathSync2(argvPath);
+    return realpathSync3(fileURLToPath3(moduleUrl)) === realpathSync3(argvPath);
   } catch {
     return moduleUrl === pathToFileURL(argvPath).href;
   }