@tablation/crew 0.108.0 → 0.109.0

package/dist/cli.js

@@ -243,7 +243,7 @@ function shellInitScript(shell) {
 
 // src/config.ts
 import { readFileSync as readFileSync11, existsSync as existsSync10 } from "fs";
-import { resolve, dirname as dirname4, isAbsolute, join as join12, basename as basename3 } from "path";
+import { resolve, dirname as dirname4, isAbsolute, join as join12, basename as basename4 } from "path";
 import { homedir as homedir6, tmpdir } from "os";
 import { parse as parse2 } from "yaml";
 
@@ -2071,8 +2071,204 @@ function explain(ship, required) {
 
 // src/repo-config.ts
 import { readFileSync as readFileSync10, existsSync as existsSync9 } from "fs";
-import { join as join11, basename as basename2 } from "path";
+import { join as join11, basename as basename3 } from "path";
 import { parse } from "yaml";
+
+// src/sandbox-policy.ts
+import { basename as basename2 } from "path";
+import { stringify } from "yaml";
+var SandboxPolicyError = class extends Error {
+};
+var PROVIDER_HOSTS = {
+  anthropic: ["api.anthropic.com", "claude.ai", "platform.claude.com"],
+  openai: ["api.openai.com", "auth.openai.com", "chatgpt.com"],
+  google: ["generativelanguage.googleapis.com", "oauth2.googleapis.com", "cloudcode-pa.googleapis.com"]
+};
+var TOOLCHAIN_HOSTS = {
+  corepack: ["registry.npmjs.org"],
+  pnpm: ["registry.npmjs.org"],
+  yarn: ["registry.npmjs.org"],
+  npm: ["registry.npmjs.org"],
+  prisma: ["binaries.prisma.sh"],
+  playwright: ["cdn.playwright.dev", "playwright.download.prss.microsoft.com"],
+  pip: ["pypi.org", "files.pythonhosted.org"],
+  cargo: ["index.crates.io", "static.crates.io"],
+  go: ["proxy.golang.org", "sum.golang.org"],
+  swift: ["download.swift.org"]
+};
+var FORBIDDEN_HOSTS = /* @__PURE__ */ new Set(["169.254.169.254", "fd00:ec2::254", "metadata.google.internal", "metadata", "localhost"]);
+var IMDS_ADDRESS = "169.254.169.254";
+var HOST = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/;
+var IPV4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+function isForbiddenIp(host) {
+  const m = IPV4.exec(host);
+  if (m) {
+    const [a, b] = [Number(m[1]), Number(m[2])];
+    return a === 127 || a === 0 || a === 10 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+  }
+  return host.includes(":");
+}
+function isAmbiguousNumericHost(host) {
+  const labels = host.split(".");
+  if (!labels.every((l) => /^(0x[0-9a-f]*|\d+)$/.test(l))) return false;
+  const canonical = labels.length === 4 && labels.every((l) => /^(0|[1-9]\d{0,2})$/.test(l) && Number(l) <= 255);
+  return !canonical;
+}
+function parseEndpoint(raw, defaultPort = 443) {
+  const s = raw.trim().toLowerCase();
+  const m = /^([^:/\s]+)(?::(\d{1,5}))?$/.exec(s);
+  if (!m) throw new SandboxPolicyError(`"${raw}" is not a host or host:port`);
+  const host = m[1];
+  const port = m[2] ? Number(m[2]) : defaultPort;
+  if (port < 1 || port > 65535) throw new SandboxPolicyError(`"${raw}" has an invalid port`);
+  if (FORBIDDEN_HOSTS.has(host) || isForbiddenIp(host)) {
+    throw new SandboxPolicyError(`"${raw}" is never reachable from a sandbox (loopback, private, link-local and cloud metadata addresses are always denied)`);
+  }
+  if (isAmbiguousNumericHost(host)) {
+    throw new SandboxPolicyError(`"${raw}" is a numeric host in a non-canonical form (hex, octal, integer or short dotted); write an IPv4 address as four plain decimal octets or use a DNS name`);
+  }
+  if (!IPV4.test(host) && !HOST.test(host)) throw new SandboxPolicyError(`"${raw}" is not a valid host name`);
+  return { host, port };
+}
+function dedupe(eps) {
+  const seen = /* @__PURE__ */ new Set();
+  return eps.filter((e) => {
+    const k = `${e.host}:${e.port}`;
+    if (seen.has(k)) return false;
+    seen.add(k);
+    return true;
+  });
+}
+function tablationEndpoint(url) {
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new SandboxPolicyError(`the route's base URL "${url}" is not a URL`);
+  }
+  const port = u.port ? Number(u.port) : u.protocol === "http:" ? 80 : 443;
+  const host = u.hostname.toLowerCase();
+  if (host !== "localhost" && (FORBIDDEN_HOSTS.has(host) || host.startsWith("169.254."))) {
+    throw new SandboxPolicyError(`the route's base URL host "${host}" is never reachable from a sandbox`);
+  }
+  return { host, port };
+}
+var TOOL_BINARIES = ["/usr/bin/curl", "/usr/bin/node", "/usr/local/bin/node", "/usr/bin/npm", "/usr/local/bin/npm", "/usr/local/bin/pnpm", "/usr/bin/corepack", "/usr/local/bin/corepack"];
+var GIT_BINARIES = ["/usr/bin/git", "/usr/lib/git-core/git-remote-http", "/usr/lib/git-core/git-remote-https"];
+function policyGroups(input) {
+  const harness = `/usr/local/bin/${basename2(input.harnessBin)}`;
+  const harnessBins = [.../* @__PURE__ */ new Set([harness, `/usr/bin/${basename2(input.harnessBin)}`, "/usr/bin/node", "/usr/local/bin/node"])];
+  const groups = [];
+  const tablation = tablationEndpoint(input.tablationUrl);
+  groups.push({
+    name: "tablation",
+    purpose: input.authMode === "workspace" ? "the tracker and the inference endpoint (the only route to a model)" : "the tracker",
+    endpoints: [tablation],
+    // curl too: the lane briefs drive the tracker API with it.
+    binaries: [...harnessBins, "/usr/bin/curl"]
+  });
+  const forge = dedupe((input.forgeHosts.length > 0 ? input.forgeHosts : ["github.com"]).map((h) => parseEndpoint(h)));
+  groups.push({ name: "forge", purpose: "clone and push the ticket branch", endpoints: forge, binaries: GIT_BINARIES });
+  if (input.authMode !== "workspace") {
+    const hosts = PROVIDER_HOSTS[input.provider];
+    if (hosts) {
+      groups.push({ name: "model", purpose: `the ${input.provider} model route (auth: ${input.authMode})`, endpoints: hosts.map((h) => parseEndpoint(h)), binaries: harnessBins });
+    }
+  }
+  const toolHosts = (input.toolchains ?? []).flatMap((t) => {
+    const hosts = TOOLCHAIN_HOSTS[t.toLowerCase()];
+    if (!hosts) throw new SandboxPolicyError(`sandbox toolchain "${t}" is not one crew knows the download hosts of (known: ${Object.keys(TOOLCHAIN_HOSTS).join(", ")}); declare its hosts under sandbox.hosts instead`);
+    return hosts.map((h) => parseEndpoint(h));
+  });
+  if (toolHosts.length > 0) {
+    groups.push({ name: "toolchains", purpose: "run-time downloads of the declared toolchains", endpoints: dedupe(toolHosts), binaries: TOOL_BINARIES });
+  }
+  const extras = dedupe((input.extraHosts ?? []).map((h) => parseEndpoint(h)));
+  if (extras.length > 0) {
+    groups.push({ name: "declared", purpose: "hosts the repository's sandbox: section declares", endpoints: extras, binaries: [.../* @__PURE__ */ new Set([...TOOL_BINARIES, ...harnessBins])] });
+  }
+  return groups;
+}
+function generateSandboxPolicy(input) {
+  const groups = policyGroups(input);
+  const mirror = input.mirrorDir ?? "/cache";
+  const work = input.workDir ?? "/sandbox/work";
+  const doc = {
+    version: 1,
+    // Fixed to the image's defaults; only the cache mount is added, read-only.
+    filesystem_policy: {
+      include_workdir: true,
+      read_only: ["/usr", "/lib", "/proc", "/dev/urandom", "/app", "/etc", "/var/log", "/opt/crew", mirror],
+      read_write: ["/sandbox", "/tmp", "/dev/null", work]
+    },
+    // A host that cannot enforce fails the run instead of running unconfined.
+    landlock: { compatibility: "hard_requirement" },
+    network_policies: Object.fromEntries(groups.map((g) => [g.name, {
+      name: g.name,
+      endpoints: g.endpoints.map((e) => ({ host: e.host, port: e.port })),
+      binaries: g.binaries.map((path) => ({ path }))
+    }]))
+  };
+  const header = [
+    "# Generated by crew for one sandboxed run. Do not edit: the next run replaces it.",
+    `# Auth mode: ${input.authMode}. Everything not listed below is denied, including package registries.`,
+    `# The cloud metadata address ${IMDS_ADDRESS} is denied; no rule here can match it.`,
+    ...groups.map((g) => `# ${g.name}: ${g.purpose}`),
+    ""
+  ].join("\n");
+  return { yaml: header + stringify(doc), groups, extraHosts: (input.extraHosts ?? []).map((h) => h.trim().toLowerCase()) };
+}
+function policyPathFor(streamPath) {
+  return streamPath.replace(/\.jsonl$/, "") + ".policy.yaml";
+}
+function parseSandboxNetwork(raw, file, fail) {
+  if (raw === void 0 || raw === null) return void 0;
+  if (typeof raw !== "object" || Array.isArray(raw)) throw fail(`${file}: sandbox must be a mapping`);
+  const r = raw;
+  const list = (v, where) => {
+    if (v === void 0 || v === null) return [];
+    if (!Array.isArray(v) || v.some((x) => typeof x !== "string" || x.trim() === "")) throw fail(`${file}: ${where} must be a list of non-empty strings`);
+    return v;
+  };
+  const hosts = list(r.hosts, "sandbox.hosts");
+  const toolchains = list(r.toolchains, "sandbox.toolchains");
+  for (const h of hosts) {
+    try {
+      parseEndpoint(h);
+    } catch (e) {
+      throw fail(`${file}: sandbox.hosts entry ${e.message}`);
+    }
+  }
+  for (const t of toolchains) {
+    if (!TOOLCHAIN_HOSTS[t.toLowerCase()]) throw fail(`${file}: sandbox.toolchains entry "${t}" is not known (known: ${Object.keys(TOOLCHAIN_HOSTS).join(", ")})`);
+  }
+  if (hosts.length === 0 && toolchains.length === 0) return void 0;
+  return { hosts, toolchains };
+}
+function parseDeniedRequests(log) {
+  const out = /* @__PURE__ */ new Map();
+  for (const line of log.split("\n")) {
+    if (!/\bden(y|ied|ies|ying)\b/i.test(line)) continue;
+    const pick = (keys) => {
+      for (const k of keys) {
+        const m = new RegExp(`\\b${k}[=:]\\s*"?([^\\s",}]+)`, "i").exec(line);
+        if (m) return m[1];
+      }
+      return void 0;
+    };
+    const host = pick(["dst_host", "destination_host", "host"]) ?? "?";
+    const portRaw = pick(["dst_port", "destination_port", "port"]);
+    const binary = pick(["binary", "bin", "exe", "process"]);
+    const port = portRaw && /^\d+$/.test(portRaw) ? Number(portRaw) : void 0;
+    const key = `${host}|${port ?? ""}|${binary ?? ""}`;
+    const prior = out.get(key);
+    if (prior) prior.count++;
+    else out.set(key, { host, ...port !== void 0 ? { port } : {}, ...binary ? { binary } : {}, count: 1, line: line.trim().slice(0, 400) });
+  }
+  return [...out.values()];
+}
+
+// src/repo-config.ts
 var SPEC_VERSION = 1;
 var REPO_CONFIG_FILENAMES = [".crew.yaml", ".crew.yml", ".crew.json"];
 var RepoConfigError = class extends Error {
@@ -2204,6 +2400,7 @@ function parseSandbox(raw, file) {
       throw new RepoConfigError(`${file}: sandbox.image and sandbox.packages are alternatives \u2014 a published image already carries its packages; put the rest in sandbox.setup`);
     }
   }
+  if (!image && packages.length === 0 && setup.length === 0 && warm.length === 0) return void 0;
   return { ...image ? { image } : {}, packages, setup, warm };
 }
 function parseRepoConfig(text2, file) {
@@ -2224,7 +2421,8 @@ function parseRepoConfig(text2, file) {
   rejectUnknown(raw.branch, BRANCH_KEYS, "branch", file);
   rejectUnknown(raw.worktrees, /* @__PURE__ */ new Set(["copy", "prefix", "name"]), "worktrees", file);
   rejectUnknown(raw.docs, /* @__PURE__ */ new Set(["triagePolicy", "designGuide"]), "docs", file);
-  rejectUnknown(raw.sandbox, /* @__PURE__ */ new Set(["image", "packages", "setup", "warm"]), "sandbox", file);
+  rejectUnknown(raw.sandbox, /* @__PURE__ */ new Set(["image", "packages", "setup", "warm", "hosts", "toolchains"]), "sandbox", file);
+  const sandboxNetwork = parseSandboxNetwork(raw.sandbox, file, (m) => new RepoConfigError(m));
   if (raw.version === void 0) throw new RepoConfigError(`${file}: version is required`);
   if (raw.version !== SPEC_VERSION) {
     throw new RepoConfigError(
@@ -2415,6 +2613,7 @@ function parseRepoConfig(text2, file) {
     shell: raw.shell ? String(raw.shell) : void 0,
     hooks,
     labels,
+    ...sandboxNetwork ? { sandboxNetwork } : {},
     release: {
       mode,
       ship,
@@ -2475,7 +2674,7 @@ function renderWorktreeName(template, ctx) {
   return renderBranchName(template.replace(/\{dir\}/g, ctx.dir), ctx);
 }
 function defaultWorktreePrefix(dir) {
-  const name = basename2(dir.replace(/[/\\]+$/, ""));
+  const name = basename3(dir.replace(/[/\\]+$/, ""));
   return name ? `${name}-issue-` : "issue-";
 }
 var DEFAULTS = {
@@ -2660,7 +2859,7 @@ function effectiveBranchTemplate(cfg, prefix) {
 function effectiveWorktreeDirName(cfg, dir, branchName, number, renderName) {
   if (cfg.worktrees.name && renderName) return renderName(cfg.worktrees.name);
   if (cfg.provenance["worktrees.prefix"] !== "default") return `${cfg.worktrees.prefix}${number}`;
-  return `${basename2(dir.replace(/[/\\]+$/, ""))}-${branchName}`;
+  return `${basename3(dir.replace(/[/\\]+$/, ""))}-${branchName}`;
 }
 function validateEffective(cfg) {
   const problems = [];
@@ -3483,7 +3682,7 @@ function dirForRepo(r, repoId) {
 }
 function repoTargetFor(r, repoId) {
   const names = r.resolved?.repoNames;
-  if (!repoId || !names) return Object.keys(r.repos).length || r.dirIsCloneBase ? null : { name: basename3(r.dir), dir: r.dir };
+  if (!repoId || !names) return Object.keys(r.repos).length || r.dirIsCloneBase ? null : { name: basename4(r.dir), dir: r.dir };
   const name = names[repoId];
   if (!name) return null;
   return reposOf(r).find((t) => t.name === name) ?? null;
@@ -3585,7 +3784,7 @@ function reposOf(r) {
       ...hosts[id] ? { forgeHost: hosts[id] } : {}
     }));
   }
-  if (trackerNames.length <= 1) return [{ name: basename3(r.dir), dir: r.dir }];
+  if (trackerNames.length <= 1) return [{ name: basename4(r.dir), dir: r.dir }];
   const remotes = r.resolved?.repoRemotes ?? {};
   const remoteByName = {};
   const hostByName = {};
@@ -4490,7 +4689,7 @@ import {
   readdirSync as readdirSync4,
   rmSync as rmSync8
 } from "fs";
-import { dirname as dirname6, basename as basename4, join as join14 } from "path";
+import { dirname as dirname6, basename as basename5, join as join14 } from "path";
 var GitError = class extends Error {
 };
 function streamText(x) {
@@ -4634,7 +4833,7 @@ function deleteRemoteBranch(cwd, remote, branch) {
 }
 function worktreeForNumber(cwd, num) {
   const re = new RegExp(`(?:^|-)${num}$`);
-  return worktrees(cwd).find((w) => re.test(basename4(w.path))) ?? null;
+  return worktrees(cwd).find((w) => re.test(basename5(w.path))) ?? null;
 }
 var commitBodies = (cwd, range) => gitOk(cwd, ["log", range, "--format=%B"]) ?? "";
 var resolve2 = (cwd, ref) => gitOk(cwd, ["rev-parse", "-q", "--verify", `${ref}^{commit}`]);
@@ -4871,7 +5070,7 @@ function recoverStrandedReleaseCheckouts(cwd) {
     else if (line.startsWith("branch refs/heads/crew/release-") && path) {
       gitOk(cwd, ["worktree", "remove", "--force", path]);
       const root = dirname6(path);
-      if (basename4(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
+      if (basename5(root).startsWith("crew-release-")) rmSync8(root, { recursive: true, force: true });
     }
   }
   const stranded = (gitOk(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/crew/release-*"]) ?? "").split("\n").filter(Boolean);
@@ -5377,8 +5576,8 @@ function attentionProblems(items, already) {
 import { createHash as createHash6 } from "crypto";
 import { spawn as spawn4 } from "child_process";
 import { execFileSync as execFileSync6 } from "child_process";
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync21, renameSync as renameSync3, writeFileSync as writeFileSync15, rmSync as rmSync13 } from "fs";
-import { dirname as dirname9, join as join26 } from "path";
+import { mkdirSync as mkdirSync14, readFileSync as readFileSync21, renameSync as renameSync3, writeFileSync as writeFileSync15, rmSync as rmSync13 } from "fs";
+import { dirname as dirname10, join as join26 } from "path";
 import { tmpdir as tmpdir3 } from "os";
 
 // src/passenger-containers.ts
@@ -5399,10 +5598,10 @@ import { join as join24 } from "path";
 
 // src/agent.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { readFileSync as readFileSync19, existsSync as existsSync21, statSync as statSync7, mkdirSync as mkdirSync12, writeFileSync as writeFileSync14, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
+import { readFileSync as readFileSync19, existsSync as existsSync21, statSync as statSync7, mkdirSync as mkdirSync13, writeFileSync as writeFileSync14, createWriteStream, openSync as openSync3, closeSync as closeSync3, readSync } from "fs";
 import { StringDecoder } from "string_decoder";
 import { finished } from "stream/promises";
-import { join as join23, dirname as dirname8, basename as basename8 } from "path";
+import { join as join23, dirname as dirname9, basename as basename9 } from "path";
 import { createHash as createHash4 } from "crypto";
 
 // src/state.ts
@@ -5908,7 +6107,7 @@ var State = class _State {
 };
 
 // src/environment.ts
-import { basename as basename5 } from "path";
+import { basename as basename6 } from "path";
 var API_KEY_VAR = "CREW_API_KEY";
 function authorshipBullets(a, contract) {
   if (!a) return [];
@@ -5961,7 +6160,7 @@ function repoSection(r, key, heading) {
   const repo = r.config;
   const branchTemplate = effectiveBranchTemplate(repo, repoPrefix(repo));
   const branchName = branchExample(repo, key);
-  const checkoutName = basename5(r.dir.replace(/[/\\]+$/, ""));
+  const checkoutName = basename6(r.dir.replace(/[/\\]+$/, ""));
   const worktreeName = effectiveWorktreeDirName(
     repo,
     r.dir,
@@ -6848,7 +7047,7 @@ import { existsSync as existsSync18, mkdirSync as mkdirSync11, readdirSync as re
 import { join as join19 } from "path";
 
 // src/ticket-branch.ts
-import { basename as basename6 } from "path";
+import { basename as basename7 } from "path";
 
 // src/tracker.ts
 import { hostname } from "os";
@@ -7866,7 +8065,7 @@ function worktreeForTicket(dir, cfg, t, role) {
   const number = t.issue_id.replace(/^\D+/, "");
   const { tag } = ticketBranchContext(t);
   return effectiveWorktreeDirName(cfg, dir, branchName, number, (template) => renderWorktreeName(template, {
-    dir: basename6(dir.replace(/[/\\]+$/, "")),
+    dir: basename7(dir.replace(/[/\\]+$/, "")),
     key: t.issue_id,
     title: t.title ?? void 0,
     role,
@@ -9433,9 +9632,9 @@ function skillMarkerWarnings(promptsDir, personaPrompts) {
 
 // src/runner.ts
 import { spawn as spawn2, execFile, execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync, writeFileSync as writeFileSync13, rmSync as rmSync12 } from "fs";
+import { mkdtempSync, mkdirSync as mkdirSync12, writeFileSync as writeFileSync13, rmSync as rmSync12 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename7, join as join22 } from "path";
+import { basename as basename8, dirname as dirname8, join as join22 } from "path";
 import { promisify } from "util";
 
 // src/run-limit.ts
@@ -9555,8 +9754,20 @@ var SandboxRunner = class {
     if (cfg.forgeTokenVar && o.env[cfg.forgeTokenVar] !== void 0 && !secretKeys.includes(cfg.forgeTokenVar)) secretKeys.push(cfg.forgeTokenVar);
     const createEnv = { ...process.env, ...plan.setEnv };
     if (cfg.forgeTokenVar && o.env[cfg.forgeTokenVar] !== void 0) createEnv[cfg.forgeTokenVar] = o.env[cfg.forgeTokenVar];
+    let policyFile = cfg.policy;
+    let generated;
+    if (!policyFile && plan.sandboxPolicy) {
+      try {
+        generated = generateSandboxPolicy({ mirrorDir: cfg.mirrorDir, workDir: cfg.workDir, ...plan.sandboxPolicy });
+      } catch (e) {
+        throw new Error(`cannot generate the sandbox policy: ${e.message}`);
+      }
+      policyFile = policyPathFor(plan.streamPath);
+      mkdirSync12(dirname8(policyFile), { recursive: true });
+      writeFileSync13(policyFile, generated.yaml, { mode: 384 });
+    }
     const create2 = ["sandbox", "create", "--name", name, "--detach"];
-    if (cfg.policy) create2.push("--policy", cfg.policy);
+    if (policyFile) create2.push("--policy", policyFile);
     if (cfg.image) create2.push("--from", cfg.image);
     if (cfg.cacheVolume) {
       create2.push("--driver-config-json", JSON.stringify({
@@ -9575,6 +9786,13 @@ var SandboxRunner = class {
     }
     o.emit.emit(`sandbox_created: ${name}`, { role: plan.role, data: { event: "sandbox_created", sandbox: name, ms: Date.now() - t0 } });
     const handle = { runner: "sandbox", sandbox: name, sandboxBin: cfg.bin };
+    if (generated) {
+      const hosts = generated.groups.flatMap((g) => g.endpoints.map((e) => `${e.host}:${e.port}`));
+      o.emit.emit(`sandbox_policy: ${hosts.length} allowed endpoint(s)${generated.extraHosts.length ? `; declared by the repository: ${generated.extraHosts.join(", ")}` : ""}`, {
+        role: plan.role,
+        data: { event: "sandbox_policy", sandbox: name, file: policyFile, allowed: hosts, declared: generated.extraHosts }
+      });
+    }
     try {
       const branch = `crew-run-${name.slice(-8)}`;
       const clone = cloneScript({
@@ -9586,7 +9804,7 @@ var SandboxRunner = class {
         lockfile: cfg.depsLockfile ?? DEFAULT_CACHE_SETTINGS.depsLockfile
       });
       await this.os(["sandbox", "exec", "-n", name, "--no-login-shell", "--", "sh", "-c", clone]);
-      const harness = cfg.agentBin ?? basename7(plan.bin);
+      const harness = cfg.agentBin ?? basename8(plan.bin);
       const viaUpload = Buffer.byteLength(plan.prompt) > SANDBOX_STDIN_LIMIT;
       if (viaUpload) {
         const tmp = mkdtempSync(join22(tmpdir2(), "crew-prompt-"));
@@ -9622,10 +9840,28 @@ var SandboxRunner = class {
   }
   async release(handle, emit) {
     if (!handle.sandbox) return;
+    await this.foldDenied(handle.sandbox, handle.sandboxBin, emit);
     const t0 = Date.now();
     await this.deleteQuietly(handle.sandbox, handle.sandboxBin);
     emit.emit(`sandbox_deleted: ${handle.sandbox}`, { data: { event: "sandbox_deleted", sandbox: handle.sandbox, ms: Date.now() - t0 } });
   }
+  /**
+   * Denied requests from the sandbox log become `sandbox_denied` events in the
+   * run's event stream (CREW-2801), so an agent blocked by policy is diagnosable
+   * from the Mac app. Read before the delete, which takes the log with it.
+   */
+  async foldDenied(name, bin, emit) {
+    let log;
+    try {
+      log = (await execFileP(bin ?? this.cfg.bin, ["logs", name], { timeout: 15e3, maxBuffer: 16 * 1024 * 1024 })).stdout;
+    } catch {
+      return;
+    }
+    for (const d of parseDeniedRequests(log)) {
+      const where = `${d.host}${d.port !== void 0 ? `:${d.port}` : ""}${d.binary ? ` by ${d.binary}` : ""}`;
+      emit.warn(`sandbox_denied: ${where}${d.count > 1 ? ` (${d.count}x)` : ""} \u2014 blocked by the sandbox policy`, { data: { event: "sandbox_denied", sandbox: name, ...d } });
+    }
+  }
   async deleteQuietly(name, bin = this.cfg.bin) {
     try {
       await execFileP(bin, ["sandbox", "delete", name], { timeout: 6e4 });
@@ -9687,6 +9923,26 @@ function assemblePrompt(p) {
 }
 var AgentError = class extends Error {
 };
+function sandboxPolicyInputFor(route2, toolchain, o) {
+  const repos = reposOf(route2);
+  const forgeHosts = [...new Set(repos.map((r) => r.forgeHost ?? "github.com"))];
+  const dir = repos.find((r) => r.name === o.repo)?.dir ?? route2.dir;
+  let declared = null;
+  try {
+    declared = loadRepoConfig(dir);
+  } catch {
+  }
+  return {
+    forgeHosts,
+    tablationUrl: route2.baseUrl,
+    authMode: toolchain.auth ?? "inherit",
+    provider: toolchainProvider(toolchain),
+    harnessBin: o.sandbox?.agentBin ?? o.harnessBin,
+    ...declared?.sandboxNetwork ? { extraHosts: declared.sandboxNetwork.hosts, toolchains: declared.sandboxNetwork.toolchains } : {},
+    ...o.sandbox?.mirrorDir ? { mirrorDir: o.sandbox.mirrorDir } : {},
+    ...o.sandbox?.workDir ? { workDir: o.sandbox.workDir } : {}
+  };
+}
 var AgentSpawnError = class extends AgentError {
 };
 var WorkspaceAuthRefused = class extends AgentSpawnError {
@@ -9822,7 +10078,11 @@ function planAgentRun(o) {
     workspaceAuth: toolchain.auth === "workspace",
     provider: toolchainProvider(toolchain),
     maxRunMinutes: resolveMaxRunMinutes(o.route.maxRunMinutes, toolchain.maxRunMinutes),
-    ...o.ship.runner === "sandbox" ? { runner: "sandbox", ...o.ship.sandbox ? { sandboxConfig: o.ship.sandbox } : {} } : {},
+    ...o.ship.runner === "sandbox" ? {
+      runner: "sandbox",
+      ...o.ship.sandbox ? { sandboxConfig: o.ship.sandbox } : {},
+      sandboxPolicy: sandboxPolicyInputFor(o.route, toolchain, { harnessBin: invocation.bin, repo: o.repo, sandbox: o.ship.sandbox })
+    } : {},
     resolution: { toolchain: seat.toolchainWhy, model: seat.modelWhy },
     warnings: [...seat.warnings ?? [], ...expanded.warnings],
     prompt,
@@ -9926,7 +10186,7 @@ async function killForDeadline(kill, pid, emit, role, ticket, spawnedAt, limitMi
 var withoutKey = ({ apiKey: _apiKey, ...rest }) => rest;
 function openSink(path) {
   try {
-    mkdirSync12(dirname8(path), { recursive: true });
+    mkdirSync13(dirname9(path), { recursive: true });
     return createWriteStream(path, { flags: "a" });
   } catch {
     return void 0;
@@ -10215,7 +10475,7 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
       if (sent.counterWarning) emit.warn(sent.counterWarning, { step: "agent" });
       if (sent.counterRetry) {
         try {
-          queueTicketCounters(stateDirOfStream(id.streamPath), basename8(id.streamPath, ".jsonl"), {
+          queueTicketCounters(stateDirOfStream(id.streamPath), basename9(id.streamPath, ".jsonl"), {
             version: 1,
             route: id.route,
             role: id.role,
@@ -10230,7 +10490,7 @@ async function finishRun(id, obs, emit, startedAt, end, agentLogKey, hintMoved)
     } catch (e) {
       if (e instanceof AgentLogUnreachableError) {
         try {
-          queueAgentRun(stateDirOfStream(id.streamPath), basename8(id.streamPath, ".jsonl"), {
+          queueAgentRun(stateDirOfStream(id.streamPath), basename9(id.streamPath, ".jsonl"), {
             version: 1,
             route: id.route,
             role: id.role,
@@ -10268,7 +10528,7 @@ function spawnAgent(plan, emit, hintMoved) {
   const id = identityOf(plan, adapter.harness);
   let streamFd;
   try {
-    mkdirSync12(dirname8(plan.streamPath), { recursive: true });
+    mkdirSync13(dirname9(plan.streamPath), { recursive: true });
     streamFd = openSync3(plan.streamPath, "a");
   } catch (e) {
     void endSink(eventsSink);
@@ -11543,7 +11803,7 @@ function readSandboxState(stateDir) {
   }
 }
 function writeSandboxState(stateDir, state) {
-  mkdirSync13(stateDir, { recursive: true });
+  mkdirSync14(stateDir, { recursive: true });
   const file = sandboxStatePath(stateDir);
   writeFileSync15(`${file}.tmp`, `${JSON.stringify(state, null, 2)}
 `);
@@ -11596,17 +11856,17 @@ async function buildSandboxImage(plan, deps) {
     return { kind: "reused", tag: plan.tag };
   }
   const logDir = sandboxLogDir(deps.stateDir);
-  mkdirSync13(logDir, { recursive: true });
+  mkdirSync14(logDir, { recursive: true });
   const logPath = join26(logDir, `${slug(plan.repo)}-${now().toISOString().replace(/[:.]/g, "-")}.log`);
   const builtLayers = [];
   for (const layer of plan.layers) {
     if (deps.hasImage(layer.tag)) continue;
     const ctx = join26(tmpdir3(), `crew-sandbox-${hash([layer.tag, process.pid, Date.now()])}`);
-    mkdirSync13(ctx, { recursive: true });
+    mkdirSync14(ctx, { recursive: true });
     try {
       writeFileSync15(join26(ctx, "Dockerfile"), layer.dockerfile);
       for (const [name, content] of Object.entries(layer.files)) {
-        mkdirSync13(dirname9(join26(ctx, name)), { recursive: true });
+        mkdirSync14(dirname10(join26(ctx, name)), { recursive: true });
         writeFileSync15(join26(ctx, name), content);
       }
       const code = await deps.run(["build", "--tag", layer.tag, "--file", join26(ctx, "Dockerfile"), ctx], logPath);
@@ -11787,7 +12047,7 @@ function roleCapWarnings(ship) {
 
 // src/selftest.ts
 import { spawn as spawn5 } from "child_process";
-import { existsSync as existsSync25, mkdirSync as mkdirSync14, mkdtempSync as mkdtempSync2, readFileSync as readFileSync22, rmSync as rmSync14, writeFileSync as writeFileSync16 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync15, mkdtempSync as mkdtempSync2, readFileSync as readFileSync22, rmSync as rmSync14, writeFileSync as writeFileSync16 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join27 } from "path";
 var SELFTEST_TIMEOUT_MS = 12e4;
@@ -11995,7 +12255,7 @@ function readSelftest(stateDir) {
 function recordSelftest(stateDir, results) {
   const all = readSelftest(stateDir);
   for (const r of results) all[r.toolchain] = r;
-  mkdirSync14(stateDir, { recursive: true });
+  mkdirSync15(stateDir, { recursive: true });
   writeFileSync16(fileFor2(stateDir), `${JSON.stringify(all, null, 2)}
 `);
 }
@@ -12008,7 +12268,7 @@ function doctorSelftestLines(stored, toolchains) {
 }
 
 // src/cli.ts
-import { resolve as resolve6, dirname as dirname27, join as join49, basename as basename15 } from "path";
+import { resolve as resolve6, dirname as dirname28, join as join49, basename as basename16 } from "path";
 import { fileURLToPath } from "url";
 import { hostname as hostname4, homedir as homedir11 } from "os";
 import { spawnSync as spawnSync10 } from "child_process";
@@ -12205,8 +12465,8 @@ function rosterMarkdown(roster, meId) {
 }
 
 // src/connect-resume.ts
-import { mkdirSync as mkdirSync15, readFileSync as readFileSync23, rmSync as rmSync15, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname10, join as join28 } from "path";
+import { mkdirSync as mkdirSync16, readFileSync as readFileSync23, rmSync as rmSync15, writeFileSync as writeFileSync17 } from "fs";
+import { dirname as dirname11, join as join28 } from "path";
 function lastSessionFile(stateDir) {
   return join28(stateDir, "connect-session.json");
 }
@@ -12226,7 +12486,7 @@ function readPointers(stateDir) {
 }
 function writePointers(stateDir, pointers) {
   const file = lastSessionFile(stateDir);
-  mkdirSync15(dirname10(file), { recursive: true });
+  mkdirSync16(dirname11(file), { recursive: true });
   writeFileSync17(file, `${JSON.stringify(pointers, null, 2)}
 `, { mode: 384 });
 }
@@ -12312,8 +12572,8 @@ async function signOutSessions(o) {
 }
 
 // src/reset.ts
-import { existsSync as existsSync26, mkdirSync as mkdirSync16, readFileSync as readFileSync24, readdirSync as readdirSync12, rmSync as rmSync16, statSync as statSync8, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname11, join as join29 } from "path";
+import { existsSync as existsSync26, mkdirSync as mkdirSync17, readFileSync as readFileSync24, readdirSync as readdirSync12, rmSync as rmSync16, statSync as statSync8, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname12, join as join29 } from "path";
 import { hostFromUrl as hostFromUrl3 } from "@tablation/client";
 function clonedCheckoutsFile(stateDir) {
   return join29(stateDir, "cloned-checkouts.json");
@@ -12330,7 +12590,7 @@ function recordClonedCheckout(stateDir, dir) {
   const known = readClonedCheckouts(stateDir);
   if (known.includes(dir)) return;
   const file = clonedCheckoutsFile(stateDir);
-  mkdirSync16(dirname11(file), { recursive: true });
+  mkdirSync17(dirname12(file), { recursive: true });
   writeFileSync18(file, `${JSON.stringify([...known, dir], null, 2)}
 `);
 }
@@ -12511,9 +12771,9 @@ async function runDeprovision(o, fx, deps) {
 }
 
 // src/pool-member.ts
-import { mkdirSync as mkdirSync17, readFileSync as readFileSync25, renameSync as renameSync4, writeFileSync as writeFileSync19 } from "fs";
+import { mkdirSync as mkdirSync18, readFileSync as readFileSync25, renameSync as renameSync4, writeFileSync as writeFileSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { dirname as dirname12, join as join30 } from "path";
+import { dirname as dirname13, join as join30 } from "path";
 var POOL_EXIT = { ok: 0, failed: 1, credential: 2 };
 function backoffMs(attempt) {
   return Math.min(6e4, 5e3 * 2 ** Math.max(0, attempt));
@@ -12715,7 +12975,7 @@ function fileMemberStore(dir) {
       }
     },
     write(f) {
-      mkdirSync17(dirname12(file), { recursive: true, mode: 448 });
+      mkdirSync18(dirname13(file), { recursive: true, mode: 448 });
       const tmp = `${file}.tmp`;
       writeFileSync19(tmp, `${JSON.stringify(f)}
 `, { mode: 384 });
@@ -12775,8 +13035,8 @@ import { hostname as hostname3 } from "os";
 // src/machine-id.ts
 import { execFileSync as execFileSync8 } from "child_process";
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync27, mkdirSync as mkdirSync18, readFileSync as readFileSync26, writeFileSync as writeFileSync20 } from "fs";
-import { dirname as dirname13, join as join31 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync19, readFileSync as readFileSync26, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname14, join as join31 } from "path";
 function machineIdPathFor(stateDir) {
   return join31(stateDir, "machine-id");
 }
@@ -12810,7 +13070,7 @@ function ensureMachineId(stateDir, opts = {}) {
   const raw = (opts.read ?? readRawMachineId)();
   if (!raw) return void 0;
   const hashed = sha256(raw);
-  mkdirSync18(dirname13(path), { recursive: true });
+  mkdirSync19(dirname14(path), { recursive: true });
   writeFileSync20(path, `${hashed}
 `, { mode: 384 });
   return hashed;
@@ -12833,8 +13093,8 @@ import { parseDocument as parseDocument2 } from "yaml";
 
 // src/repos-cmd.ts
 import { homedir as homedir9 } from "os";
-import { basename as basename9, join as join32, resolve as resolve3 } from "path";
-import { isMap, isSeq, parseDocument, stringify } from "yaml";
+import { basename as basename10, join as join32, resolve as resolve3 } from "path";
+import { isMap, isSeq, parseDocument, stringify as stringify2 } from "yaml";
 var ReposError = class extends Error {
 };
 function normalizeRemote(url) {
@@ -12905,7 +13165,7 @@ function configuredRepos(text2, route2, base) {
     });
   }
   const dir = m.get("dir");
-  return dir ? [{ name: basename9(String(dir)), dir: expandDir(String(dir), base) }] : [];
+  return dir ? [{ name: basename10(String(dir)), dir: expandDir(String(dir), base) }] : [];
 }
 function cloneBaseOf(text2, route2, base, isCheckout) {
   const m = routeMapOf(parseDocument(text2), route2);
@@ -12994,7 +13254,7 @@ function planRepoAdd(i) {
     throw new ReposError(`${target} is already configured on route ${i.route}`);
   }
   const matched = matchRepoName(i.origin, i.resolved);
-  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename9(target);
+  const name = matched ?? i.name ?? normalizeRemote(i.origin)?.split("/").pop() ?? basename10(target);
   let warning;
   if (!matched) {
     const known = Object.values(i.resolved?.repoNames ?? {});
@@ -13047,7 +13307,7 @@ function planRepoRemove(text2, base, route2, path) {
   return { text: String(doc), name: hit.name };
 }
 function renderBlock(m) {
-  return stringify([m.toJSON()]).trimEnd();
+  return stringify2([m.toJSON()]).trimEnd();
 }
 var LOCAL_RELEASE_MODES = /* @__PURE__ */ new Set(["integrate", "external"]);
 function planRepoRow(i) {
@@ -13454,7 +13714,7 @@ host=${host}
 
 // src/tunnel.ts
 import { spawn as spawn6 } from "child_process";
-import { existsSync as existsSync29, mkdirSync as mkdirSync19, readFileSync as readFileSync28, writeFileSync as writeFileSync22, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync20, readFileSync as readFileSync28, writeFileSync as writeFileSync22, unlinkSync as unlinkSync3, readdirSync as readdirSync13 } from "fs";
 import { randomInt } from "crypto";
 import { join as join33 } from "path";
 var DEFAULT_SPAWN_OPTIONS = { stdio: "ignore", detached: true };
@@ -13541,7 +13801,7 @@ function readPersistedTunnel(stateDir, workspaceId) {
 }
 function writePersistedTunnel(stateDir, state) {
   const path = tunnelStatePath(stateDir, state.workspaceId);
-  mkdirSync19(join33(stateDir, "passengers"), { recursive: true });
+  mkdirSync20(join33(stateDir, "passengers"), { recursive: true });
   writeFileSync22(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -15005,8 +15265,8 @@ async function resolveOne(tracker, t, seat, approvedStatus, buildingStatus, affi
 }
 
 // src/repo-refresh.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, readFileSync as readFileSync29, writeFileSync as writeFileSync24 } from "fs";
-import { dirname as dirname15 } from "path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync21, readFileSync as readFileSync29, writeFileSync as writeFileSync24 } from "fs";
+import { dirname as dirname16 } from "path";
 var REFRESH_COOLDOWN_MS = 2 * 6e4;
 var UNSERVABLE_PASSES_BEFORE_ATTENTION = 3;
 var lastAsked = /* @__PURE__ */ new Map();
@@ -15038,7 +15298,7 @@ function persistRepoRows(stateDir, routeName, rows) {
   if (!existsSync31(path)) return;
   const raw = JSON.parse(readFileSync29(path, "utf8"));
   applyRepoRows(raw, rows);
-  mkdirSync20(dirname15(path), { recursive: true });
+  mkdirSync21(dirname16(path), { recursive: true });
   writeFileSync24(path, `${JSON.stringify(raw, null, 2)}
 `);
 }
@@ -15489,9 +15749,9 @@ Ship ${shipName2} found: ${problem}. The release refuses to squash a ref nobody
 var localRefSkipReported = (ticket, problem, events) => events.some((e) => e.record_id === ticket.id && e.event_type === "local_ref_skip" && (e.message ?? "").includes(problem));
 
 // src/connect-wizard.ts
-import { delimiter, dirname as dirname16, join as join35 } from "path";
-import { accessSync as accessSync3, constants as constants3, existsSync as existsSync32, mkdirSync as mkdirSync21, writeFileSync as writeFileSync25 } from "fs";
-import { stringify as stringify2 } from "yaml";
+import { delimiter, dirname as dirname17, join as join35 } from "path";
+import { accessSync as accessSync3, constants as constants3, existsSync as existsSync32, mkdirSync as mkdirSync22, writeFileSync as writeFileSync25 } from "fs";
+import { stringify as stringify3 } from "yaml";
 var HOST_PASSENGERS_DOCS_URL = "https://crew.tablation.dev/host-passengers";
 function shouldRunWizard(opts) {
   if (!opts.isTTY) return false;
@@ -15538,9 +15798,9 @@ async function runWizard(p, env) {
     if (entered && isExec(entered)) agentBin = entered;
     else p.say(entered ? `${entered} is not an executable file.` : "A path is required.");
   }
-  const nodeDir = dirname16(env.nodePath);
+  const nodeDir = dirname17(env.nodePath);
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
-  const baseDirs = [nodeDir, pnpmPath ? dirname16(pnpmPath) : void 0];
+  const baseDirs = [nodeDir, pnpmPath ? dirname17(pnpmPath) : void 0];
   p.say(
     `
 Host Passengers lets this machine run the agent sessions that other people's
@@ -15551,14 +15811,14 @@ Tablation workspaces ask for, in a container. More: ${HOST_PASSENGERS_DOCS_URL}`
     p.say("Docker is not available here, so nothing will be hosted until it is. Your answer is recorded anyway.");
   }
   const dockerPath = hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname16(dockerPath) : void 0]);
+  const extraPath = deriveExtraPath([...baseDirs, dockerPath ? dirname17(dockerPath) : void 0]);
   if (extraPath) {
     p.say(`Hooks will get ${extraPath} on their PATH (where node, pnpm${dockerPath ? " and docker" : ""} live).`);
   }
   return { name, platform: env.platform, agentBin, extraPath, hostPassengers };
 }
 function renderShipBlock(a) {
-  return stringify2({
+  return stringify3({
     ship: {
       name: a.name,
       platform: a.platform,
@@ -15573,7 +15833,7 @@ routes:
 ${routeBlock}`;
 }
 function writeNewConfig(path, text2) {
-  mkdirSync21(dirname16(path), { recursive: true });
+  mkdirSync22(dirname17(path), { recursive: true });
   try {
     writeFileSync25(path, text2, { mode: 384, flag: "wx" });
     return true;
@@ -15609,7 +15869,7 @@ Wrote ${o.configPath}.
 // src/connect-json.ts
 import { accessSync as accessSync4, constants as constants4 } from "fs";
 import { homedir as homedir10 } from "os";
-import { dirname as dirname17, join as join36 } from "path";
+import { dirname as dirname18, join as join36 } from "path";
 import { delimiter as delimiter2 } from "path";
 var CHOICE_EXIT_CODE = 3;
 function createEmitter(json2, write) {
@@ -15675,7 +15935,7 @@ function flagWizardAnswers(f, env) {
   const agentBin = f.agentBin ?? found?.bin;
   const pnpmPath = findOnPath2("pnpm", env.pathEnv, isExec);
   const dockerPath = f.hostPassengers ? findOnPath2("docker", env.pathEnv, isExec) : void 0;
-  const extraPath = f.extraPath ?? deriveExtraPath([dirname17(env.nodePath), pnpmPath ? dirname17(pnpmPath) : void 0, dockerPath ? dirname17(dockerPath) : void 0]);
+  const extraPath = f.extraPath ?? deriveExtraPath([dirname18(env.nodePath), pnpmPath ? dirname18(pnpmPath) : void 0, dockerPath ? dirname18(dockerPath) : void 0]);
   return {
     answers: {
       name: f.shipName?.trim() || env.hostname,
@@ -15689,8 +15949,8 @@ function flagWizardAnswers(f, env) {
 }
 
 // src/release-run.ts
-import { readFileSync as readFileSync30, writeFileSync as writeFileSync26, existsSync as existsSync33, copyFileSync, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync3, rmSync as rmSync17 } from "fs";
-import { dirname as dirname18, join as join37 } from "path";
+import { readFileSync as readFileSync30, writeFileSync as writeFileSync26, existsSync as existsSync33, copyFileSync, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync3, rmSync as rmSync17 } from "fs";
+import { dirname as dirname19, join as join37 } from "path";
 import { tmpdir as tmpdir5 } from "os";
 
 // src/release.ts
@@ -16576,7 +16836,7 @@ function openReleaseCheckout(o) {
   for (const f of o.repo.worktrees.copy) {
     const src = join37(o.cwd, f);
     if (!existsSync33(src)) continue;
-    mkdirSync22(dirname18(join37(dir, f)), { recursive: true });
+    mkdirSync23(dirname19(join37(dir, f)), { recursive: true });
     copyFileSync(src, join37(dir, f));
   }
   return { dir, branch, close };
@@ -17895,8 +18155,8 @@ function nextRoles(decision, ran) {
 }
 
 // src/ship-name.ts
-import { existsSync as existsSync35, mkdirSync as mkdirSync23, readFileSync as readFileSync31, renameSync as renameSync5, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname19 } from "path";
+import { existsSync as existsSync35, mkdirSync as mkdirSync24, readFileSync as readFileSync31, renameSync as renameSync5, writeFileSync as writeFileSync27 } from "fs";
+import { dirname as dirname20 } from "path";
 import { parseDocument as parseDocument5 } from "yaml";
 var ShipNameError = class extends Error {
 };
@@ -17975,7 +18235,7 @@ function writeSyncedName(resolvedFile, name) {
   }
   if (raw.shipName === name) return;
   raw.shipName = name;
-  mkdirSync23(dirname19(resolvedFile), { recursive: true });
+  mkdirSync24(dirname20(resolvedFile), { recursive: true });
   const tmp = `${resolvedFile}.tmp${process.pid}`;
   writeFileSync27(tmp, `${JSON.stringify(raw, null, 2)}
 `);
@@ -18668,8 +18928,8 @@ function describeCapability(i) {
 }
 
 // src/agents-sync-run.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync24, readFileSync as readFileSync32, writeFileSync as writeFileSync28 } from "fs";
-import { dirname as dirname20 } from "path";
+import { existsSync as existsSync36, mkdirSync as mkdirSync25, readFileSync as readFileSync32, writeFileSync as writeFileSync28 } from "fs";
+import { dirname as dirname21 } from "path";
 async function runAgentsSync(target, o) {
   const dryRun = o.dryRun ?? false;
   const force = o.force ?? false;
@@ -18706,7 +18966,7 @@ async function runAgentsSync(target, o) {
     raw.agentPersonas = personaResult.agentPersonas;
     if (skillResult) raw.agentSkills = skillResult.agentSkills;
     if (personaResult.releaseAgentId) raw.releaseAgentId = personaResult.releaseAgentId;
-    mkdirSync24(dirname20(resolvedPath), { recursive: true });
+    mkdirSync25(dirname21(resolvedPath), { recursive: true });
     writeFileSync28(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
     if (target.resolved) {
@@ -18812,11 +19072,11 @@ async function showLogEntry(route2, entryId, opts = {}) {
 // src/repos-check.ts
 import { spawnSync as spawnSync9 } from "child_process";
 import { readFileSync as readFileSync33 } from "fs";
-import { basename as basename10 } from "path";
+import { basename as basename11 } from "path";
 var POSIX_SHELL = /^(?:ba|z|da|k|a|mk)?sh$|^fish$/;
 function checkHookSyntax(script, shell) {
   const spec = resolveShell(shell);
-  const name = basename10(spec.bin).replace(/\.exe$/i, "").toLowerCase();
+  const name = basename11(spec.bin).replace(/\.exe$/i, "").toLowerCase();
   let run3;
   if (POSIX_SHELL.test(name)) {
     run3 = spawnSync9(spec.bin, ["-n"], { input: script, encoding: "utf8" });
@@ -18835,7 +19095,7 @@ function checkHookSyntax(script, shell) {
   return { status: "error", message };
 }
 function renderSamples(cfg, dir) {
-  const checkout = basename10(dir.replace(/[/\\]+$/, ""));
+  const checkout = basename11(dir.replace(/[/\\]+$/, ""));
   const tagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", tag: "TABL-123", prefix: "tabl", lowercase: cfg.branch.lowercase };
   const untagged = { key: "ISSUE-123", title: "Fix the widget", role: "dev", lowercase: cfg.branch.lowercase };
   return [["with a project tag", tagged], ["without a project tag", untagged]].map(([label, ctx]) => {
@@ -19299,7 +19559,7 @@ ${run3.err}` });
 }
 
 // src/sample-ticket.ts
-import { basename as basename11, dirname as dirname21, join as join38 } from "path";
+import { basename as basename12, dirname as dirname22, join as join38 } from "path";
 var SAMPLE_REPO = "crew-sample";
 var SAMPLE_REMOTE = `local/${SAMPLE_REPO}`;
 var SAMPLE_MARKER = "sample: true";
@@ -19322,7 +19582,7 @@ has something safe to work on: its test and build hooks always pass, it has no
 remote, and \`crew sample-ticket --remove\` deletes it.
 `;
 function sampleDir(existing, reposBase, workspace) {
-  if (existing.length > 0) return join38(dirname21(existing[0]), SAMPLE_REPO);
+  if (existing.length > 0) return join38(dirname22(existing[0]), SAMPLE_REPO);
   return join38(reposBase, workspace, SAMPLE_REPO);
 }
 var SAMPLE_TITLE = "Sample: add a documented `greet` function with a test";
@@ -19368,7 +19628,7 @@ function planSampleTicket(i) {
 
 // src/worktree-sweep.ts
 import { existsSync as existsSync37, readFileSync as readFileSync34, readdirSync as readdirSync14 } from "fs";
-import { basename as basename12, dirname as dirname22, join as join39, resolve as resolve4 } from "path";
+import { basename as basename13, dirname as dirname23, join as join39, resolve as resolve4 } from "path";
 function planWorktreeSweep(target, tickets, contract) {
   const terminal = new Set(contract.statuses.resolved.filter((s) => s !== contract.statuses.verified));
   const verified = contract.statuses.verified;
@@ -19409,7 +19669,7 @@ function ticketForWorktree(w, byNumber, contract) {
     const t = num ? byNumber.get(num) : void 0;
     if (t && ticketStems(t).has(stem)) return t;
   }
-  const dir = basename12(w.path);
+  const dir = basename13(w.path);
   const m = DIR_NUMBER.exec(dir);
   if (m && byNumber.has(m[1])) return byNumber.get(m[1]);
   if (!w.branch) {
@@ -19425,15 +19685,15 @@ function worktreeTicketNumbers(target) {
       const n = /-(\d+)$/.exec(BRANCH_STEM.exec(w.branch)?.[1] ?? "")?.[1];
       if (n) nums.add(n);
     }
-    const m = DIR_NUMBER_SUFFIXED.exec(basename12(w.path));
+    const m = DIR_NUMBER_SUFFIXED.exec(basename13(w.path));
     if (m) nums.add(m[1]);
   }
   for (const d of siblingWorktreeDirs(target)) nums.add(d.number);
   return [...nums];
 }
 function siblingWorktreeDirs(target) {
-  const parent = dirname22(target.dir.replace(/[/\\]+$/, ""));
-  const stem = `${basename12(target.dir.replace(/[/\\]+$/, ""))}-`;
+  const parent = dirname23(target.dir.replace(/[/\\]+$/, ""));
+  const stem = `${basename13(target.dir.replace(/[/\\]+$/, ""))}-`;
   const registered = new Set(worktrees(target.dir).map((w) => resolve4(w.path)));
   let names;
   try {
@@ -19458,7 +19718,7 @@ function orphanedWorktreeDirs(target, tickets, contract) {
 }
 function warnOrphanedWorktreeDirs(paths, log, held) {
   for (const p of paths) {
-    const number = DIR_NUMBER_SUFFIXED.exec(basename12(p))?.[1];
+    const number = DIR_NUMBER_SUFFIXED.exec(basename13(p))?.[1];
     const when = held && number ? noteHeldWorktree(held.state, { repo: held.repo, path: p, ticket: number, status: "deployed", reason: "orphaned directory" }) : "first";
     if (when) {
       log.warn(`orphaned directory ${p}: its ticket is deployed but it is not a registered worktree; the sweep will not delete it \u2014 remove it by hand`, { step: "worktree" });
@@ -19602,7 +19862,7 @@ function isTicketBranch(name, base, stems) {
 }
 function sweepCandidatesExist(cwd, base) {
   const linked = worktrees(cwd).slice(1);
-  if (linked.some((w) => DIR_NUMBER_SUFFIXED.test(basename12(w.path)) || w.branch && BRANCH_STEM.test(w.branch))) return true;
+  if (linked.some((w) => DIR_NUMBER_SUFFIXED.test(basename13(w.path)) || w.branch && BRANCH_STEM.test(w.branch))) return true;
   if (siblingWorktreeDirs({ name: "", dir: cwd }).length) return true;
   return localBranches(cwd).some((b) => b !== base && /-\d+(?:-.*)?$/.test(b));
 }
@@ -19698,11 +19958,11 @@ function planEventsSweep(stateDir, retentionDays, now = Date.now()) {
 }
 
 // src/cli.ts
-import { realpathSync as realpathSync3, readFileSync as readFileSync40, existsSync as existsSync45, mkdirSync as mkdirSync31, writeFileSync as writeFileSync33, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync14, readdirSync as readdirSync20 } from "fs";
+import { realpathSync as realpathSync3, readFileSync as readFileSync40, existsSync as existsSync45, mkdirSync as mkdirSync32, writeFileSync as writeFileSync33, rmSync as rmSync23, unlinkSync as unlinkSync5, copyFileSync as copyFileSync2, renameSync as renameSync6, statSync as statSync14, readdirSync as readdirSync20 } from "fs";
 import { createInterface } from "readline/promises";
 
 // src/periscope-cmd.ts
-import { existsSync as existsSync39, mkdirSync as mkdirSync25, readFileSync as readFileSync35, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
+import { existsSync as existsSync39, mkdirSync as mkdirSync26, readFileSync as readFileSync35, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
 import { join as join41 } from "path";
 var PeriscopeError = class extends Error {
 };
@@ -19720,7 +19980,7 @@ function removePeriscopePrior(stateDir, ticketRecordId) {
 }
 function writePeriscopePrior(stateDir, ticketRecordId, prior) {
   try {
-    mkdirSync25(priorDir(stateDir), { recursive: true });
+    mkdirSync26(priorDir(stateDir), { recursive: true });
     writeFileSync29(priorPath(stateDir, ticketRecordId), JSON.stringify(prior));
   } catch {
   }
@@ -20223,8 +20483,8 @@ import { dirname as dirOf2, resolve as resolvePath } from "path";
 
 // src/ssh-keys.ts
 import { execFileSync as execFileSync11 } from "child_process";
-import { existsSync as existsSync40, mkdirSync as mkdirSync26, readFileSync as readFileSync36, chmodSync as chmodSync3 } from "fs";
-import { dirname as dirname23, join as join43 } from "path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync27, readFileSync as readFileSync36, chmodSync as chmodSync3 } from "fs";
+import { dirname as dirname24, join as join43 } from "path";
 var SshKeyError = class extends Error {
 };
 function shipSshKeyPathFor(stateDir) {
@@ -20234,7 +20494,7 @@ function ensureShipSshKeypair(stateDir) {
   const privateKeyPath = shipSshKeyPathFor(stateDir);
   const publicKeyPath = `${privateKeyPath}.pub`;
   if (!existsSync40(privateKeyPath)) {
-    mkdirSync26(dirname23(privateKeyPath), { recursive: true });
+    mkdirSync27(dirname24(privateKeyPath), { recursive: true });
     try {
       execFileSync11("ssh-keygen", [
         "-t",
@@ -20421,12 +20681,12 @@ async function unregisterEndpoint(workspaceId, info, d) {
 import { createServer as createHttpServer } from "http";
 import { spawn as spawn8 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync41, mkdirSync as mkdirSync28, readFileSync as readFileSync37, writeFileSync as writeFileSync30, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
+import { existsSync as existsSync41, mkdirSync as mkdirSync29, readFileSync as readFileSync37, writeFileSync as writeFileSync30, unlinkSync as unlinkSync4, readdirSync as readdirSync16 } from "fs";
 import { join as join44 } from "path";
 
 // src/passenger-mirror.ts
-import { mkdirSync as mkdirSync27 } from "fs";
-import { dirname as dirname24 } from "path";
+import { mkdirSync as mkdirSync28 } from "fs";
+import { dirname as dirname25 } from "path";
 function mirrorRepoOf(spec) {
   const fromOrigin = spec.originUrl ? parseRemote(spec.originUrl) : null;
   if (fromOrigin) return fromOrigin;
@@ -20444,9 +20704,9 @@ async function materializeMirrorCheckouts(specs, cacheFor = (s) => new SandboxCa
       continue;
     }
     try {
-      const parent = dirname24(spec.dir);
-      mkdirSync27(parent, { recursive: true });
-      mkdirSync27(spec.dir, { recursive: true });
+      const parent = dirname25(spec.dir);
+      mkdirSync28(parent, { recursive: true });
+      mkdirSync28(spec.dir, { recursive: true });
       const r = await cacheFor(spec).materialize(repo, spec.base, parent, spec.name);
       out.push({ ...base, action: r.changed ? "updated" : "unchanged", detail: r.tip });
     } catch (e) {
@@ -20565,7 +20825,7 @@ function readPersistedSyncDaemon(stateDir, workspaceId) {
 }
 function writePersistedSyncDaemon(stateDir, state) {
   const path = syncDaemonStatePath(stateDir, state.workspaceId);
-  mkdirSync28(join44(stateDir, "passengers"), { recursive: true });
+  mkdirSync29(join44(stateDir, "passengers"), { recursive: true });
   writeFileSync30(path, `${JSON.stringify(state, null, 2)}
 `);
 }
@@ -20675,7 +20935,7 @@ function describeCause(err3) {
 }
 
 // src/daemon.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync29, readFileSync as readFileSync38, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync12, writeFileSync as writeFileSync31 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync30, readFileSync as readFileSync38, readdirSync as readdirSync17, rmSync as rmSync20, statSync as statSync12, writeFileSync as writeFileSync31 } from "fs";
 import { join as join45 } from "path";
 import { randomBytes as randomBytes2 } from "crypto";
 var DEFAULT_FLOOR_MS = 5e3;
@@ -20789,7 +21049,7 @@ function daemonStampFor(stateDir) {
   return join45(stateDir, "daemon.started");
 }
 function noteDaemonStarted(stateDir, now = Date.now()) {
-  mkdirSync29(stateDir, { recursive: true });
+  mkdirSync30(stateDir, { recursive: true });
   rmSync20(reloadSentinelFor(stateDir), { force: true });
   writeFileSync31(daemonStampFor(stateDir), `${JSON.stringify({ pid: process.pid, startedAt: now })}
 `);
@@ -21373,7 +21633,7 @@ import {
 } from "fs";
 import { createConnection } from "net";
 import { createServer } from "http";
-import { basename as basename13, dirname as dirname25, join as join46 } from "path";
+import { basename as basename14, dirname as dirname26, join as join46 } from "path";
 import { execFile as execFile3, spawn as spawn10 } from "child_process";
 
 // src/periscope-control.ts
@@ -21689,7 +21949,7 @@ function candidates(live, rotated) {
   const out = [live];
   if (!rotated) return out;
   try {
-    for (const n of readdirSync18(dirname25(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join46(dirname25(live), n));
+    for (const n of readdirSync18(dirname26(live))) if (ROTATED_EVENTS_RE.test(n)) out.push(join46(dirname26(live), n));
   } catch {
   }
   return out;
@@ -21812,7 +22072,7 @@ function pauseDoc(state) {
 }
 function describeStream(r) {
   return {
-    run: basename13(r.streamPath).replace(/\.jsonl$/, ""),
+    run: basename14(r.streamPath).replace(/\.jsonl$/, ""),
     pid: r.pid,
     ticket: r.ticket,
     role: r.role,
@@ -21849,7 +22109,7 @@ async function tailReply(path, q2, rotated, abort) {
   const deadline = Date.now() + Math.min(wait, MAX_WAIT_SECONDS) * 1e3;
   let r = readTail(path, { after, tail: tail3, rotated });
   while (after && !r.lines.length && !r.reset && Date.now() < deadline && !abort.aborted) {
-    await waitForChange(dirname25(path), deadline - Date.now(), abort);
+    await waitForChange(dirname26(path), deadline - Date.now(), abort);
     r = readTail(path, { after: r.cursor, rotated });
   }
   return reply2(200, r);
@@ -22039,21 +22299,21 @@ function crewJson(args, timeoutMs = 6e4) {
 
 // src/periscope-mcp.ts
 import { lstat, mkdir, readdir, readFile, readlink, realpath, rm, stat, writeFile } from "fs/promises";
-import { basename as basename14, dirname as dirname26, isAbsolute as isAbsolute3, join as join48, relative as relative2, resolve as resolve5, sep } from "path";
+import { basename as basename15, dirname as dirname27, isAbsolute as isAbsolute3, join as join48, relative as relative2, resolve as resolve5, sep } from "path";
 import { z } from "zod";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 
 // src/periscope-endpoints.ts
 import { randomBytes as randomBytes3 } from "crypto";
-import { chmodSync as chmodSync5, existsSync as existsSync44, mkdirSync as mkdirSync30, readdirSync as readdirSync19, readFileSync as readFileSync39, rmSync as rmSync22, writeFileSync as writeFileSync32 } from "fs";
+import { chmodSync as chmodSync5, existsSync as existsSync44, mkdirSync as mkdirSync31, readdirSync as readdirSync19, readFileSync as readFileSync39, rmSync as rmSync22, writeFileSync as writeFileSync32 } from "fs";
 import { join as join47 } from "path";
 var secretDir = (stateDir) => join47(stateDir, "periscope-mcp");
 var secretFile = (stateDir, id) => join47(secretDir(stateDir), `${id}.json`);
 var endpointDir = (stateDir) => join47(stateDir, "periscope-endpoints");
 var endpointFile = (stateDir, id) => join47(endpointDir(stateDir), `${id}.json`);
 function mintPeriscopeSecret(stateDir, ticketRecordId) {
-  mkdirSync30(secretDir(stateDir), { recursive: true, mode: 448 });
+  mkdirSync31(secretDir(stateDir), { recursive: true, mode: 448 });
   const secret = randomBytes3(32).toString("base64url");
   const file = secretFile(stateDir, ticketRecordId);
   writeFileSync32(file, `${JSON.stringify({ secret })}
@@ -22080,7 +22340,7 @@ function readPeriscopeEndpoint(stateDir, ticketRecordId) {
   }
 }
 function writePeriscopeEndpoint(stateDir, rec) {
-  mkdirSync30(endpointDir(stateDir), { recursive: true });
+  mkdirSync31(endpointDir(stateDir), { recursive: true });
   writeFileSync32(endpointFile(stateDir, rec.ticketRecordId), `${JSON.stringify(rec, null, 2)}
 `);
 }
@@ -22177,12 +22437,12 @@ async function realAncestor(p) {
     }
     if (isLink) {
       if (++hops > 40) throw new PathRefusal(`too many symbolic links resolving ${p}`);
-      cur = resolve5(dirname26(cur), await readlink(cur));
+      cur = resolve5(dirname27(cur), await readlink(cur));
       continue;
     }
-    const parent = dirname26(cur);
+    const parent = dirname27(cur);
     if (parent === cur) throw new PathRefusal(`cannot resolve ${p}`);
-    tail3.push(basename14(cur));
+    tail3.push(basename15(cur));
     cur = parent;
   }
 }
@@ -22291,7 +22551,7 @@ function createPeriscopeMcpServer(d, sc) {
     if (Buffer.byteLength(content) > MAX_WRITE_BYTES) return text(`content exceeds ${MAX_WRITE_BYTES} bytes`, true);
     const abs = await inTree(path);
     if (abs === await realpath(root)) return text("path must name a file", true);
-    await mkdir(dirname26(abs), { recursive: true });
+    await mkdir(dirname27(abs), { recursive: true });
     await inTree(path);
     await writeFile(abs, content);
     return text(`Wrote ${Buffer.byteLength(content)} bytes to ${await rel(abs)}`);
@@ -22331,9 +22591,9 @@ function createPeriscopeMcpServer(d, sc) {
     inputSchema: { path: z.string() },
     annotations: { readOnlyHint: false, destructiveHint: true, openWorldHint: false }
   }, async ({ path }) => {
-    const parent = await inTree(dirname26(path) === "" ? "." : dirname26(path));
-    const abs = join48(parent, basename14(path));
-    if (basename14(path) === ".git" || abs === parent) return text("path must name a file", true);
+    const parent = await inTree(dirname27(path) === "" ? "." : dirname27(path));
+    const abs = join48(parent, basename15(path));
+    if (basename15(path) === ".git" || abs === parent) return text("path must name a file", true);
     const st = await lstat(abs).catch(() => void 0);
     if (!st) return text(`${path} does not exist`, true);
     if (st.isDirectory()) return text(`${path} is a directory; only files are deleted`, true);
@@ -22453,7 +22713,7 @@ function findPeriscope(sidecars, segment) {
 }
 
 // src/cli.ts
-var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname27(process.execPath) : resolve6(dirname27(fileURLToPath(import.meta.url)), "..");
+var CREW_HOME = isCompiledBinary(import.meta.url) ? dirname28(process.execPath) : resolve6(dirname28(fileURLToPath(import.meta.url)), "..");
 var RELEASE_LOCK_TTL_MS = 20 * 60 * 1e3;
 var CYCLE_SECONDS2 = 120;
 var STALE_CYCLES = 3;
@@ -22620,6 +22880,7 @@ function usage(problem, requested = false) {
   crew selftest [route] [--toolchain NAME] [--json]   launch each toolchain as a run would and prove it reaches the tracker
   crew sample-ticket [route] [--remove] [--dry-run] [--json]   file one ticket on a throwaway repo that walks the dev, QA and release loop
   crew ports [route]             which checkout owns which ports, and what is up
+  crew sandbox policy --route R --role ROLE [--repo NAME] [--json]   print the sandbox policy a run of that role would get
   crew reap [route]              kill orphaned servers, drop worktrees for closed tickets
   crew drop [route] NNN          remove a merged ticket's worktree and branch
   crew rotate-passenger-url [route]   force a Host Passengers tunnel to reconnect with a fresh public URL
@@ -24878,7 +25139,7 @@ ${cu.tail.trimEnd()}
         const resolvedPath = resolvedPathFor(cfg.ship.stateDir, target.route);
         const raw = existsSync45(resolvedPath) ? JSON.parse(readFileSync40(resolvedPath, "utf8")) : {};
         raw.agentSkills = result.agentSkills;
-        mkdirSync31(dirOf2(resolvedPath), { recursive: true });
+        mkdirSync32(dirOf2(resolvedPath), { recursive: true });
         writeFileSync33(resolvedPath, `${JSON.stringify(raw, null, 2)}
 `);
       }
@@ -24956,7 +25217,7 @@ ${cu.tail.trimEnd()}
           const found = cfg.routes.find((r) => r.route === routeArg);
           if (!found) throw new ReposError(`no route "${routeArg}" in the config (have: ${cfg.routes.map((r) => r.route).join(", ") || "none"})`);
           const named2 = value("route") ? void 0 : positional[3];
-          const dir = named2 ? repoDirOf(configText, dirname27(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
+          const dir = named2 ? repoDirOf(configText, dirname28(cfg.configFile), found.route, named2) : resolvePath(positional[value("route") ? 2 : 3] ?? ".");
           const target = reposOf(found).find((t) => resolvePath(t.dir) === dir || t.name === named2);
           const o = target ? found.repoOverrides[target.name] : void 0;
           runReposCheck(dir, {
@@ -24979,7 +25240,7 @@ ${cu.tail.trimEnd()}
       if (sub === "hooks") {
         try {
           const a = parseHooksArgs(positional.slice(2), routeNamesOf(configText));
-          const dir = repoDirOf(configText, dirname27(cfg.configFile), a.route, a.name);
+          const dir = repoDirOf(configText, dirname28(cfg.configFile), a.route, a.name);
           if (!existsSync45(dir)) throw new ReposError(`${dir} does not exist on disk`);
           const files = { exists: (r) => existsSync45(resolvePath(dir, r)), list: (r) => {
             try {
@@ -25146,7 +25407,7 @@ ${cu.tail.trimEnd()}
       }
       const originOf = (dir) => gitOk(dir, ["remote", "get-url", "origin"]) ?? void 0;
       const text2 = configText;
-      const base = dirname27(cfg.configFile);
+      const base = dirname28(cfg.configFile);
       const isCheckout = (d) => existsSync45(`${d}/.git`);
       try {
         if (sub === "list") {
@@ -25822,7 +26083,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
           process.stderr.write(`(dry run) would write resolved ids to ${resolvedPath}
 `);
         } else {
-          mkdirSync31(dirname27(resolvedPath), { recursive: true });
+          mkdirSync32(dirname28(resolvedPath), { recursive: true });
           if (hadPreviousFile) copyFileSync2(resolvedPath, `${resolvedPath}.bak`);
           const tmpPath = `${resolvedPath}.tmp${process.pid}`;
           writeFileSync33(tmpPath, `${JSON.stringify(resolved, null, 2)}
@@ -25871,7 +26132,7 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
             process.stderr.write(`(dry run) would write the minted API key to ${apiKeyFile}
 `);
           } else {
-            mkdirSync31(dirname27(apiKeyFile), { recursive: true });
+            mkdirSync32(dirname28(apiKeyFile), { recursive: true });
             writeFileSync33(apiKeyFile, `${apiKeyVar}=${apiKey}
 `, { mode: 384 });
             process.stderr.write(`API key written to ${apiKeyFile}
@@ -26171,6 +26432,39 @@ Signed in as ${result.identity.email} \u2014 minted an API key in workspace "${r
       }
       break;
     }
+    case "sandbox": {
+      if (positional[1] !== "policy") {
+        process.stderr.write("crew sandbox policy --route ROUTE --role ROLE [--repo NAME] [--json]\n");
+        process.exit(2);
+      }
+      const only = value("route");
+      const wanted = only ? cfg.routes.filter((r2) => r2.route === only) : cfg.routes;
+      if (wanted.length !== 1) {
+        process.stderr.write(`crew sandbox policy: ${only ? `no route "${only}"` : "name the route with --route"} (have: ${cfg.routes.map((r2) => r2.route).join(", ")})
+`);
+        process.exit(2);
+      }
+      const role = value("role") ?? "dev";
+      if (!ROLE_NAMES.includes(role)) {
+        process.stderr.write(`crew sandbox policy: --role must be one of ${ROLE_NAMES.join(", ")}
+`);
+        process.exit(2);
+      }
+      const r = wanted[0];
+      const repoName = value("repo");
+      const seat = resolveSeat(cfg.ship, r, role, {}, repoName);
+      const input = sandboxPolicyInputFor(r, seat.toolchain, { harnessBin: seat.toolchain.bin, repo: repoName, sandbox: cfg.ship.sandbox });
+      try {
+        const policy = generateSandboxPolicy({ mirrorDir: cfg.ship.sandbox?.mirrorDir, workDir: cfg.ship.sandbox?.workDir, ...input });
+        process.stdout.write(flag("json") ? `${JSON.stringify({ route: r.route, role, input, groups: policy.groups, yaml: policy.yaml }, null, 2)}
+` : policy.yaml);
+      } catch (e) {
+        process.stderr.write(`crew sandbox policy: ${e.message}
+`);
+        process.exit(1);
+      }
+      break;
+    }
     case "reap": {
       emit.enter("worktree");
       let anything = false;
@@ -26768,7 +27062,7 @@ ${where.join("\n")}`);
             for (const f of repoP.config.worktrees.copy) {
               const src = join49(repoP.dir, f);
               if (!existsSync45(src)) continue;
-              mkdirSync31(dirOf2(join49(path, f)), { recursive: true });
+              mkdirSync32(dirOf2(join49(path, f)), { recursive: true });
               copyFileSync2(src, join49(path, f));
             }
             const setup = repoP.config.hooks.setup;
@@ -27117,7 +27411,7 @@ ${where.join("\n")}`);
         process.stdout.write("crew reload: no daemon unit is running \u2014 nothing to reload (the next run reads crew.yaml fresh)\n");
         break;
       }
-      mkdirSync31(cfg.ship.stateDir, { recursive: true });
+      mkdirSync32(cfg.ship.stateDir, { recursive: true });
       writeFileSync33(sentinel, `${(/* @__PURE__ */ new Date()).toISOString()}
 `);
       process.stdout.write(
@@ -27207,7 +27501,7 @@ ${where.join("\n")}`);
       if (!route2.resolved) fail(`route ${route2.route} is not connected \u2014 run \`crew connect\` first`);
       const tracker = new Tracker(route2, cfg.ship);
       const configText = readFileSync40(cfg.configFile, "utf8");
-      const cfgBase = dirname27(cfg.configFile);
+      const cfgBase = dirname28(cfg.configFile);
       const configured2 = configuredRepos(configText, route2.route, cfgBase);
       const dir = configured2.find((r) => r.name === SAMPLE_REPO)?.dir ?? sampleDir(configured2.map((r) => r.dir), route2.reposBasePath, route2.route.split("/")[0]);
       const resolvedFile = resolvedPathFor(cfg.ship.stateDir, route2.route);
@@ -27251,7 +27545,7 @@ ${where.join("\n")}`);
 `);
           }
         }
-        if (existsSync45(join49(dir, ".git")) && basename15(dir) === SAMPLE_REPO) rmSync23(dir, { recursive: true, force: true });
+        if (existsSync45(join49(dir, ".git")) && basename16(dir) === SAMPLE_REPO) rmSync23(dir, { recursive: true, force: true });
         say("removed", { dir, closed }, `removed the sample repo${closed.length ? `, closed ${closed.join(", ")}` : ""}`);
         break;
       }
@@ -27263,7 +27557,7 @@ ${where.join("\n")}`);
         break;
       }
       if (fresh) {
-        mkdirSync31(dir, { recursive: true });
+        mkdirSync32(dir, { recursive: true });
         writeFileSync33(join49(dir, "README.md"), SAMPLE_README);
         writeFileSync33(join49(dir, ".crew.yaml"), SAMPLE_CREW_YAML);
         const g = (...a) => {
@@ -27567,7 +27861,7 @@ ${where.join("\n")}`);
               // `synthesis-tabl-123`. `worktreePrefix` above is kept for
               // config-provenance display; this is the field that actually
               // describes where a worktree lands by default.
-              worktreeDirPattern: r.config.worktrees.name ?? (r.config.provenance["worktrees.prefix"] !== "default" ? `${r.config.worktrees.prefix}<number>` : `${basename15(r.dir.replace(/[/\\]+$/, ""))}-<branch>`),
+              worktreeDirPattern: r.config.worktrees.name ?? (r.config.provenance["worktrees.prefix"] !== "default" ? `${r.config.worktrees.prefix}<number>` : `${basename16(r.dir.replace(/[/\\]+$/, ""))}-<branch>`),
               worktreeParent: resolvePath(r.dir, "..")
             })),
             waiting: waiting ? { ticket: waiting.ticket, since: waiting.since, streak: fairness.streak() } : null
@@ -27825,7 +28119,7 @@ routes:            ${cfg.routes.map((c) => c.route).join(", ")}
       );
       for (const r of await resolvedRepos(route2)) {
         const { config } = r;
-        const worktreePattern = config.worktrees.name ?? (config.provenance["worktrees.prefix"] !== "default" ? `${config.worktrees.prefix}<number>` : `${basename15(r.dir.replace(/[/\\]+$/, ""))}-${effectiveBranchTemplate(config, void 0)}`);
+        const worktreePattern = config.worktrees.name ?? (config.provenance["worktrees.prefix"] !== "default" ? `${config.worktrees.prefix}<number>` : `${basename16(r.dir.replace(/[/\\]+$/, ""))}-${effectiveBranchTemplate(config, void 0)}`);
         process.stdout.write(
           `${`repo ${r.name}:`.padEnd(19)}${r.dir}
                    worktrees at ../${worktreePattern} (${config.provenance["worktrees.name"] ?? config.provenance["worktrees.prefix"] ?? "default"}), branch ${config.branch.name}