@trim21/personal-pi-extensions 0.0.216 → 0.0.222

package/src/bwrap/index.ts

@@ -1,588 +1,38 @@
-/**
- * bwrap Sandbox Extension
- *
- * Wraps all bash commands in bubblewrap (bwrap) for OS-level sandboxing.
- * No external dependencies — uses only Node.js built-ins.
- *
- * System requirements: bwrap (bubblewrap) must be installed.
- *   - Debian/Ubuntu: apt install bubblewrap
- *   - Arch: pacman -S bubblewrap
- *   - Fedora: dnf install bubblewrap
- *
- * ## Modes
- *
- * Four modes, switchable at runtime:
- *
- *   allow-all       No sandbox. Network allowed. All commands run natively.
- *   workspace-write Sandbox enabled, network blocked. Project dir + /tmp writable.
- *                   Model can request full access via bash tool parameter.
- *   allow-net       Sandbox enabled, network allowed. Project dir + /tmp writable.
- *   readonly        Sandbox enabled, network blocked, no writable paths.
- *
- * ## Escalation
- *
- * The bash tool is re-registered with `request_full_access` and
- * `request_full_access_reason` parameters. When full access is needed,
- * the model must explain why (e.g., network required, writing outside workspace).
- *
- * Models should try sandbox mode first when unsure. If the command fails due to
- * sandbox restrictions, retry with full access and provide the failure reason.
- *
- * Config files (merged, project takes precedence):
- *   - ~/.pi/agent/extensions/bwrap.json (global)
- *   - .pi/bwrap.json (project-local)
- *
- * Example .pi/bwrap.json:
- * ```json
- * {
- *   "mode": "workspace-write",
- *   "writablePaths": [".", "/tmp"],
- *   "tmpfsPaths": [],
- *   "extraArgs": []
- * }
- * ```
- *
- * Commands:
- *   /bwrap              Show current mode and paths
- *   /bwrap-allow-all    Full access, sandbox off
- *   /bwrap-workspace-write  Sandbox on, workspace writable
- *   /bwrap-allow-net    Sandbox on, network on, workspace writable
- *   /bwrap-readonly     Sandbox on, no writes
- *
- * Usage:
- *   pi -e ./bwrap
- *   pi -e ./bwrap --no-bwrap
- */
-
-import type { ChildProcess } from "node:child_process";
-import { spawn } from "node:child_process";
-import { constants } from "node:fs";
-import { closeSync, existsSync, openSync, readFileSync } from "node:fs";
-import { access as fsAccess } from "node:fs/promises";
-import { delimiter, join } from "node:path";
-import { fileURLToPath } from "node:url";
-
-import type { ExtensionAPI, ExtensionCommandContext, Theme } from "@earendil-works/pi-coding-agent";
-import { type BashOperations, createBashTool, getAgentDir } from "@earendil-works/pi-coding-agent";
-import { type TObject, Type } from "typebox";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { createBashTool } from "@earendil-works/pi-coding-agent";
+import { Type } from "typebox";
 import { Value } from "typebox/value";
 
-import { type CommandSpec, parseCommand } from "../lib/cli.js";
-import { expandHome } from "../lib/path.js";
-
-const SANDBOX_PROMPT = `
-## Command Execution
-You are running inside a sandbox.
-
-Three sandbox modes exist:
-- allow-all: sandbox off, network on, full access
-- readonly: sandbox on, network off, nothing writable
-- workspace-write: sandbox on, network off, only workspace and /tmp writable
-- allow-net: sandbox on, network on, only workspace and /tmp writable
-
-In workspace-write, allow-net and readonly modes, the bash tool has a
-\`request_full_access\` boolean parameter.
-Set it to true to request execution outside the sandbox.
-The user must approve.
-
-When requesting full access, you MUST also provide
-a \`request_full_access_reason\` string explaining why:
-  - What specific operation requires escaping the sandbox
-  - e.g. "needs network to install npm packages",
-    "needs to write to /etc/hosts which is outside the workspace"
-
-In addition to root files system, .git, .pi, and .agent directories inside workspace
-are still read-only even in workspace-write mode.
-Git operations that change git status (add, commit, push, etc.)
-require request_full_access: true.
-
-the \`request_full_access\` is only needed for:
-  - Writing to paths outside the configured writable directories,
-  - Operations requiring network access when the current mode blocks it
-    (workspace-write or readonly; allow-all and allow-net already have network).
-Writing inside the workspace or /tmp, or reading any file, does not require escalation,
-for example, the simple \`ls\`, \`cat\`, \`find\` or \`grep\` and git command that only read from .git directory but not change .git directory and other read only commands.
-**If the command is readonly operator, do not use \`request_full_access\`**
-
-**Strategy for uncertain cases**: if you are not sure whether a command will
-work inside the sandbox, run it WITHOUT full access first. If it fails with
-"Read-only file system", "Permission denied", "Network is unreachable", or
-"Could not resolve host", then retry with \`request_full_access: true\`
-and set \`request_full_access_reason\` to describe the failure.
-`;
-
-const HEADLESS_SANDBOX_PROMPT = `
-## Command Execution (headless sandbox)
-
-You are running inside a read-only sandbox without an interactive UI.
-
-- The bash tool is read-only: no filesystem writes, no network access, and
-  \`request_full_access\` is denied. Do not pass \`request_full_access\`.
-- Use the write/edit tools for file changes inside your workspace.
-- Writes outside the workspace are rejected because no UI is available for
-  approval.
-- If a command truly requires network or system-level access, explain that it
-  cannot be approved in this session.
-`;
-
-const PROTECTED_DIRS = [".git", ".pi", ".agent"];
-
-const bwrapPath = findDefaultBwrap();
-
-function findDefaultBwrap(): string {
-  const pathEnv = process.env.PATH ?? "";
-  for (const dir of pathEnv.split(delimiter)) {
-    const p = join(dir, "bwrap");
-    if (existsSync(p)) return p;
-  }
-
-  const candidates = ["/usr/bin/bwrap", "/usr/local/bin/bwrap", "/run/current-system/sw/bin/bwrap"];
-  for (const p of candidates) {
-    if (existsSync(p)) return p;
-  }
-
-  throw new Error(
-    "bwrap (bubblewrap) not found in PATH. Install it:\n" +
-      "  apt install bubblewrap (Debian/Ubuntu)\n" +
-      "  pacman -S bubblewrap (Arch)\n" +
-      "  dnf install bubblewrap (Fedora)",
-  );
-}
-
-function findBwrap(override?: string): string {
-  return override ?? bwrapPath;
-}
-
-type BwrapMode = "allow-all" | "workspace-write" | "allow-net" | "readonly";
-
-export interface BwrapConfig {
-  mode: BwrapMode;
-  bwrapPath?: string;
-  writablePaths?: string[];
-  extraWritablePaths: string[];
-  tmpfsPaths?: string[];
-  extraArgs?: string[];
-}
-
-export interface ResolvedBwrap {
-  mode: BwrapMode;
-  bwrapEnabled: boolean;
-  network: boolean;
-  bwrapPath?: string;
-  writablePaths: string[];
-  extraWritablePaths: string[];
-  tmpfsPaths: string[];
-  extraArgs: string[];
-}
-
-export function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
-  const base = {
-    mode: config.mode,
-    bwrapPath: config.bwrapPath,
-    writablePaths: config.writablePaths ?? [".", "/tmp"],
-    extraWritablePaths: config.extraWritablePaths,
-    tmpfsPaths: config.tmpfsPaths ?? [],
-    extraArgs: config.extraArgs ?? [],
-  };
-  switch (config.mode) {
-    case "allow-all": {
-      return { ...base, bwrapEnabled: false, network: true };
-    }
-    case "workspace-write": {
-      return { ...base, bwrapEnabled: true, network: false };
-    }
-    case "allow-net": {
-      return { ...base, bwrapEnabled: true, network: true };
-    }
-    case "readonly": {
-      return { ...base, bwrapEnabled: true, network: false, writablePaths: [] };
-    }
-  }
-}
-
-/**
- * Headless sessions are forced read-only regardless of config: no writable
- * paths (including configured extraWritablePaths), no network, and no
- * user-supplied extra args that could add writable mounts.
- */
-export function resolveHeadlessBwrap(config: BwrapConfig): ResolvedBwrap {
-  return resolveBwrap({
-    ...config,
-    mode: "readonly",
-    writablePaths: [],
-    extraWritablePaths: [],
-    tmpfsPaths: [],
-    extraArgs: [],
-  });
-}
-
-const DEFAULT_CONFIG: BwrapConfig = {
-  mode: "workspace-write",
-  writablePaths: [".", "/tmp"],
-  extraWritablePaths: [],
-  tmpfsPaths: [],
-  extraArgs: [],
-};
-
-function deepMerge(base: BwrapConfig, overrides: Partial<BwrapConfig>): BwrapConfig {
-  return {
-    mode: overrides.mode ?? base.mode,
-    bwrapPath: overrides.bwrapPath ?? base.bwrapPath,
-    writablePaths: overrides.writablePaths ?? base.writablePaths,
-    extraWritablePaths: [...base.extraWritablePaths, ...(overrides.extraWritablePaths ?? [])],
-    tmpfsPaths: overrides.tmpfsPaths ?? base.tmpfsPaths,
-    extraArgs: overrides.extraArgs ?? base.extraArgs,
-  };
-}
-
-function resolvePath(p: string, cwd: string): string {
-  const expanded = expandHome(p);
-  if (expanded === ".") return cwd;
-  return expanded;
-}
-
-function loadConfig(cwd: string): BwrapConfig {
-  const globalConfigPath = join(getAgentDir(), "extensions", "bwrap.json");
-  const projectConfigPath = join(cwd, ".pi", "bwrap.json");
-
-  const globalConfig: Partial<BwrapConfig> = {};
-  const projectConfig: Partial<BwrapConfig> = {};
-
-  for (const [path, target] of [
-    [globalConfigPath, globalConfig],
-    [projectConfigPath, projectConfig],
-  ] as const) {
-    if (existsSync(path)) {
-      try {
-        Object.assign(target, JSON.parse(readFileSync(path, "utf8")));
-      } catch (error) {
-        // eslint-disable-next-line no-console -- config parse warnings go to stderr
-        console.error(`Warning: Could not parse ${path}: ${String(error)}`);
-      }
-    }
-  }
-
-  return deepMerge(deepMerge(DEFAULT_CONFIG, globalConfig), projectConfig);
-}
-
-function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): string[] {
-  // Process-isolation flags placed before filesystem mounts.
-  //   --new-session     Escape the parent TTY (no Ctrl-C leakage)
-  //   --die-with-parent Auto-SIGTERM child when the bwrap parent exits
-  //   --unshare-user    User namespace (root-inside-ns ≠ host root)
-  //   --unshare-pid     PID namespace (kill(-1) confined to sandbox)
-  const args: string[] = ["--new-session", "--die-with-parent", "--unshare-user", "--unshare-pid"];
-
-  for (const path of resolved.writablePaths) {
-    const r = resolvePath(path, cwd);
-    args.push("--bind", r, r);
-  }
-  for (const path of resolved.extraWritablePaths) {
-    const r = resolvePath(path, cwd);
-    args.push("--bind", r, r);
-  }
-  for (const path of resolved.tmpfsPaths) {
-    const r = resolvePath(path, cwd);
-    args.push("--tmpfs", r);
-  }
-
-  if (!resolved.network) {
-    args.push("--unshare-net");
-  }
-
-  // Ro-bind protected dirs inside the workspace to override writable parent mounts
-  for (const name of PROTECTED_DIRS) {
-    const abs = join(cwd, name);
-    if (existsSync(abs)) {
-      args.push("--ro-bind", abs, abs);
-    }
-  }
-
-  args.push(...resolved.extraArgs);
-  return args;
-}
-
-// ── Lazy seccomp filter cache ────────────────────────────────────────
-// BPF bytecode is deterministic per architecture — shipped as static
-// .bpf files alongside the extension (src/bwrap/seccomp-<arch>.bpf).
-// At runtime we pick the right file and open it per-exec.
-
-const SECCOMP_BPF_FILE: string = (() => {
-  const dir = fileURLToPath(new URL(".", import.meta.url));
-  if (process.arch === "x64") return join(dir, "seccomp-x86_64.bpf");
-  if (process.arch === "arm64") return join(dir, "seccomp-aarch64.bpf");
-  return "";
-})();
-
-function getSeccompFd(): number | undefined {
-  if (!SECCOMP_BPF_FILE) return undefined;
-  try {
-    return openSync(SECCOMP_BPF_FILE, "r");
-  } catch {
-    return undefined;
-  }
-}
-
-function createBwrapBashOps(resolved: ResolvedBwrap): BashOperations {
-  return {
-    async exec(command, cwd: string, { onData, signal, timeout }) {
-      const bwrapArgs = buildBwrapArgs(resolved, cwd);
-      try {
-        await fsAccess(cwd, constants.F_OK);
-      } catch {
-        throw new Error(`Working directory does not exist: ${cwd}\nCannot execute bash commands.`);
-      }
-      if (signal?.aborted) {
-        throw new Error("aborted");
-      }
-
-      // ── seccomp: block AF_UNIX + network syscalls ───────────────
-      // bwrap --unshare-net handles IP; seccomp closes the UNIX socket
-      // gap (Docker CLI, mysqld, etc.). Filter is generated once.
-      const seccompFd = resolved.network ? undefined : getSeccompFd();
-
-      const baseArgs: string[] = [
-        "--ro-bind",
-        "/",
-        "/",
-        ...bwrapArgs,
-        "--dev",
-        "/dev",
-        "--proc",
-        "/proc",
-      ];
-
-      // Two spawn paths so TypeScript can infer the correct child type.
-      const child: ChildProcess =
-        seccompFd === undefined
-          ? spawn(findBwrap(resolved.bwrapPath), [...baseArgs, "--", "bash", "-c", command], {
-              cwd,
-              detached: true,
-              stdio: ["ignore", "pipe", "pipe"],
-              env: process.env,
-            })
-          : spawn(
-              findBwrap(resolved.bwrapPath),
-              [...baseArgs, "--seccomp", "3", "--", "bash", "-c", command],
-              {
-                cwd,
-                detached: true,
-                stdio: ["ignore", "pipe", "pipe", seccompFd],
-                env: process.env,
-              },
-            );
-
-      return new Promise((resolve, reject) => {
-        let timedOut = false;
-        let timeoutHandle: NodeJS.Timeout | undefined;
-
-        if (timeout !== undefined && timeout > 0) {
-          timeoutHandle = setTimeout(() => {
-            timedOut = true;
-            if (child.pid) {
-              try {
-                process.kill(-child.pid, "SIGKILL");
-              } catch {
-                child.kill("SIGKILL");
-              }
-            }
-          }, timeout * 1000);
-        }
-
-        child.stdout?.on("data", onData);
-        child.stderr?.on("data", onData);
-
-        child.on("error", (err) => {
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          reject(err);
-        });
-
-        const onAbort = () => {
-          if (child.pid) {
-            try {
-              process.kill(-child.pid, "SIGKILL");
-            } catch {
-              child.kill("SIGKILL");
-            }
-          }
-        };
-
-        signal?.addEventListener("abort", onAbort, { once: true });
-
-        // ── Signal forwarding ──────────────────────────────────────
-        // With --new-session + detached, terminal signals (Ctrl-C) only
-        // reach the parent. Forward SIGHUP/SIGINT/SIGTERM to the bwrap
-        // child so the sandboxed command can react before the parent
-        // (potentially) exits. --die-with-parent already covers the
-        // case where the parent actually dies.
-        const forwardedSignals: NodeJS.Signals[] = ["SIGHUP", "SIGINT", "SIGTERM"];
-        const signalForwarders: (() => void)[] = [];
-
-        for (const sig of forwardedSignals) {
-          const handler = () => {
-            if (child.pid) {
-              try {
-                process.kill(-child.pid, sig);
-              } catch {
-                child.kill(sig);
-              }
-            }
-            // Remove ourselves and re-raise so the default handler runs.
-            process.removeListener(sig, handler);
-            process.kill(process.pid, sig);
-          };
-          process.on(sig, handler);
-          signalForwarders.push(() => process.removeListener(sig, handler));
-        }
-
-        child.on("close", (code) => {
-          if (timeoutHandle) clearTimeout(timeoutHandle);
-          signal?.removeEventListener("abort", onAbort);
-
-          // Remove signal forwarders now that the child is gone.
-          for (const unforward of signalForwarders) {
-            unforward();
-          }
-
-          // Close the per-exec seccomp fd (temp file is reused).
-          if (seccompFd !== undefined) {
-            try {
-              closeSync(seccompFd);
-            } catch {
-              /* ignore */
-            }
-          }
-
-          if (signal?.aborted) {
-            reject(new Error("aborted"));
-          } else if (timedOut) {
-            reject(new Error(`timeout:${timeout}`));
-          } else {
-            resolve({ exitCode: code });
-          }
-        });
-      });
-    },
-  };
-}
-
-function escapeHtml(text: string): string {
-  return text
-    .replaceAll("&", "&amp;")
-    .replaceAll("<", "&lt;")
-    .replaceAll(">", "&gt;")
-    .replaceAll('"', "&quot;");
-}
-
-/**
- * Count the longest consecutive backtick run in a string.
- */
-function maxConsecutiveBackticks(text: string): number {
-  let maxCount = 0;
-  let currentCount = 0;
-  for (const ch of text) {
-    if (ch === "`") {
-      currentCount++;
-      if (currentCount > maxCount) maxCount = currentCount;
-    } else {
-      currentCount = 0;
-    }
-  }
-  return maxCount;
-}
-
-/**
- * Wrap code in fenced code blocks for literal plain-text rendering.
- * Uses N+1 backticks for the fence where N is the longest consecutive
- * backtick sequence in the code, so no escaping is needed.
- */
-function fenceCodeBlock(code: string): string {
-  const fenceLen = Math.max(3, maxConsecutiveBackticks(code) + 1);
-  const fence = "`".repeat(fenceLen);
-  return `${fence}\n${code}\n${fence}`;
-}
-
-function notifyMode(
-  ctx: { ui: { notify: (m: string, t?: "info" | "warning" | "error") => void } },
-  mode: BwrapMode,
-) {
-  const labels: Record<BwrapMode, string> = {
-    "allow-all": "allow-all: sandbox off, network on",
-    "workspace-write": "workspace-write: sandbox on, network off",
-    "allow-net": "allow-net: sandbox on, network on, workspace writable",
-    readonly: "readonly: sandbox on, network off, read-only fs",
-  };
-  ctx.ui.notify(labels[mode], "info");
-}
-
-export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: string };
-
-/**
- * Escalation (`request_full_access`) policy:
- * - Headless sessions are denied because there is no user to approve.
- * - Sessions with UI require the user approval dialog.
- */
-export function resolveEscalation(opts: { hasUI: boolean }): EscalationDecision {
-  if (!opts.hasUI) {
-    return {
-      kind: "deny",
-      reason:
-        "request_full_access requires an interactive session with user approval; no UI is available in this session.",
-    };
-  }
-  return { kind: "dialog" };
-}
-
-const sandboxedBashSchema = Type.Object({
-  command: Type.String({ description: "Bash command to execute" }),
-  timeout: Type.Optional(
-    Type.Number({
-      description: "Timeout in seconds (optional, no default timeout)",
-    }),
-  ),
-  request_full_access: Type.Optional(
-    Type.Boolean({
-      description:
-        "Set to true to run the command without sandbox, the command will get full fs write permission and network access. The user will review this command and user must approve this. Do not set this if your command doesn't write any file and doesn't need network access.",
-    }),
-  ),
-  request_full_access_reason: Type.Optional(
-    Type.String({
-      description:
-        "Required when request_full_access is true. Explain why the command needs full access outside the sandbox (e.g. 'needs network for npm install', 'must write to /etc/config outside workspace').",
-    }),
-  ),
-});
-
-export default function bwrapExtension(pi: ExtensionAPI) {
-  pi.registerFlag("no-bwrap", {
-    description: "Disable bwrap sandboxing for bash commands",
-    type: "boolean",
-    default: false,
-  });
-
-  const localCwd = process.cwd();
-  const localBash = createBashTool(localCwd);
-
-  let resolved: ResolvedBwrap | null = null;
-
-  function getResolved(hasUI: boolean): ResolvedBwrap {
-    // Without an approval path, ignore config and force bash read-only.
-    if (!hasUI) {
-      return resolveHeadlessBwrap(loadConfig(localCwd));
-    }
-    if (!resolved) {
-      resolved = resolveBwrap(loadConfig(localCwd));
-    }
-    return resolved;
-  }
-
-  function setMode(mode: BwrapMode) {
-    const config = loadConfig(localCwd);
-    config.mode = mode;
-    resolved = resolveBwrap(config);
-  }
-
+import { bwrapRuntime } from "./runtime.js";
+
+export {
+  type BwrapConfig,
+  resolveBwrap,
+  type ResolvedBwrap,
+  resolveHeadlessBwrap,
+} from "./core.js";
+export { type EscalationDecision, resolveEscalation } from "./runtime.js";
+
+const sandboxedBashSchema = Type.Object(
+  {
+    command: Type.String({ description: "Bash command to execute" }),
+    timeout: Type.Optional(Type.Number({ description: "Timeout in seconds" })),
+    request_full_access: Type.Optional(
+      Type.Boolean({
+        description:
+          "Set true to request unsandboxed execution. The bwrap runtime will ask the user for approval.",
+      }),
+    ),
+    request_full_access_reason: Type.Optional(
+      Type.String({ description: "Explain why unsandboxed execution is required." }),
+    ),
+  },
+  { additionalProperties: false },
+);
+
+export default function bwrapExtension(pi: ExtensionAPI): void {
+  bwrapRuntime.setup(pi);
+  const localBash = createBashTool(process.cwd());
   pi.registerTool({
     name: localBash.name,
     label: "bash (bwrap)",
@@ -590,254 +40,19 @@ export default function bwrapExtension(pi: ExtensionAPI) {
       localBash.description +
       "\n\nSet request_full_access to true to request unsandboxed execution.",
     parameters: sandboxedBashSchema,
-    prepareArguments: (args) => {
-      return Value.Parse(sandboxedBashSchema, args);
-    },
+    prepareArguments: (args) => Value.Parse(sandboxedBashSchema, args),
     executionMode: localBash.executionMode,
-    async execute(id, params, signal, onUpdate, ctx) {
-      const hasUI = ctx?.hasUI ?? false;
-      const r = getResolved(hasUI);
-
-      if (!r.bwrapEnabled) {
-        return localBash.execute(id, params, signal, onUpdate);
-      }
-
-      const escalate = params.request_full_access === true;
-
-      if (escalate) {
-        const policy = resolveEscalation({ hasUI });
-        if (policy.kind === "deny") {
-          throw new Error(policy.reason);
-        }
-
-        if (ctx?.hasUI) {
-          const reason = params.request_full_access_reason;
-          const reasonText = reason
-            ? `\n\nReason: ${escapeHtml(reason)}`
-            : "\n\n(No reason provided by model)";
-          const codeBlock = fenceCodeBlock(params.command);
-          const desc = `Allow this command to run without sandbox?\n---\n${reasonText}\n---\n${codeBlock}`;
-
-          let choice: string | undefined;
-          while (!choice) {
-            choice = await ctx.ui.select(desc, ["Approve once", "Block", "Block with reason"]);
-            if (choice === undefined) {
-              ctx.abort();
-              throw new Error("User denied the command execution.");
-            }
-            if (choice === "Block with reason") {
-              const feedback = await ctx.ui.input("Why was this denied?");
-              if (feedback === undefined) {
-                choice = undefined; // cancelled input, retry select
-                continue;
-              }
-              throw new Error(
-                feedback
-                  ? `User denied unsandboxed execution: ${feedback}`
-                  : "User denied unsandboxed execution.",
-              );
-            }
-          }
-          if (choice !== "Approve once") {
-            throw new Error("User denied unsandboxed execution.");
-          }
-        }
-        return localBash.execute(id, params, signal, onUpdate);
-      }
-
-      const sandboxedBash = createBashTool(localCwd, {
-        operations: createBwrapBashOps(r),
+    execute(id, params, signal, onUpdate, ctx) {
+      return bwrapRuntime.execute({
+        toolCallId: id,
+        command: params.command,
+        timeout: params.timeout,
+        requestFullAccess: params.request_full_access,
+        requestFullAccessReason: params.request_full_access_reason,
+        signal,
+        onUpdate,
+        ctx,
       });
-      return sandboxedBash.execute(id, params, signal, onUpdate);
     },
   });
-
-  pi.on("session_start", (_event, ctx) => {
-    const noBwrap = pi.getFlag("no-bwrap") === true;
-
-    // Headless sessions are always sandboxed read-only because they cannot
-    // approve disabling the sandbox.
-    if (noBwrap && ctx.hasUI) {
-      resolved = null;
-      ctx.ui.notify("bwrap sandbox disabled via --no-bwrap", "warning");
-      return;
-    }
-
-    if (!process.env.HOME) {
-      ctx.ui.notify("bwrap requires HOME environment variable", "error");
-      return;
-    }
-
-    if (process.platform !== "linux") {
-      ctx.ui.notify("bwrap sandbox requires Linux", "warning");
-      return;
-    }
-
-    const config = loadConfig(ctx.cwd);
-    resolved = ctx.hasUI ? resolveBwrap(config) : resolveHeadlessBwrap(config);
-
-    if (resolved.bwrapEnabled) {
-      try {
-        findBwrap(resolved.bwrapPath);
-      } catch (error) {
-        resolved = null;
-        ctx.ui.notify(error instanceof Error ? error.message : "bwrap not found", "error");
-        return;
-      }
-    }
-
-    const r = resolved;
-
-    if (!r.bwrapEnabled) {
-      ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${r.mode}`));
-      ctx.ui.notify(`bwrap mode: ${r.mode}`, "info");
-      return;
-    }
-
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${r.mode}`));
-    ctx.ui.notify(`bwrap initialized (${r.mode})`, "info");
-  });
-
-  pi.on("session_shutdown", () => {
-    resolved = null;
-  });
-
-  pi.on("before_agent_start", (event, ctx) => {
-    const r = getResolved(ctx.hasUI);
-
-    return {
-      systemPrompt: ctx.hasUI
-        ? event.systemPrompt + "\n\n" + SANDBOX_PROMPT + `\n\nCurrent mode: **${r.mode}**\n`
-        : event.systemPrompt + "\n\n" + HEADLESS_SANDBOX_PROMPT,
-    };
-  });
-
-  const BWRAP_SPEC = {
-    name: "bwrap",
-    usage: "",
-    description: "Show bwrap sandbox configuration",
-    flags: Type.Object({}),
-    arity: { max: 0 },
-  };
-
-  const BWRAP_ALLOW_ALL_SPEC = {
-    name: "bwrap-allow-all",
-    usage: "",
-    description: "Disable bwrap sandbox, full access",
-    flags: Type.Object({}),
-    arity: { max: 0 },
-  };
-
-  const BWRAP_WORKSPACE_WRITE_SPEC = {
-    name: "bwrap-workspace-write",
-    usage: "",
-    description: "Sandbox on, network off, workspace writable",
-    flags: Type.Object({}),
-    arity: { max: 0 },
-  };
-
-  const BWRAP_ALLOW_NET_SPEC = {
-    name: "bwrap-allow-net",
-    usage: "",
-    description: "Sandbox on, network on, workspace writable",
-    flags: Type.Object({}),
-    arity: { max: 0 },
-  };
-
-  const BWRAP_READONLY_SPEC = {
-    name: "bwrap-readonly",
-    usage: "",
-    description: "Sandbox on, network off, no writes",
-    flags: Type.Object({}),
-    arity: { max: 0 },
-  };
-
-  /** Parse a /bwrap command; on help/error the text is sent to the session, otherwise run() executes. */
-  function runBwrapCommand(
-    spec: CommandSpec<TObject>,
-    args: string,
-    ctx: ExtensionCommandContext,
-    run: (ctx: ExtensionCommandContext) => void | Promise<void>,
-  ): Promise<void> {
-    const parsed = parseCommand(spec, args);
-    if (parsed.kind !== "ok") {
-      pi.sendMessage({ customType: "info", content: parsed.text, display: true });
-      return Promise.resolve();
-    }
-    return Promise.resolve(run(ctx));
-  }
-
-  pi.registerCommand("bwrap", {
-    description: BWRAP_SPEC.description,
-    handler: (args, ctx) =>
-      runBwrapCommand(BWRAP_SPEC, args, ctx, (c) => {
-        const r = getResolved(c.hasUI);
-        if (!r.bwrapEnabled) {
-          c.ui.notify(`bwrap disabled (mode: ${r.mode})`, "info");
-          return;
-        }
-
-        const net = r.network ? "net" : "no-net";
-        const w = r.writablePaths.map((p) => resolvePath(p, localCwd));
-        const t = r.tmpfsPaths.map((p) => resolvePath(p, localCwd));
-
-        c.ui.notify(
-          `bwrap ${r.mode} ${net} write:[${w.join(", ")}] tmpfs:[${t.join(", ") || "-"}]`,
-          "info",
-        );
-      }),
-  });
-
-  function switchMode(
-    mode: BwrapMode,
-    ctx: {
-      ui: {
-        notify: (m: string, t?: "info" | "warning" | "error") => void;
-        theme: Theme;
-        setStatus: (k: string, t: string | undefined) => void;
-      };
-      hasUI: boolean;
-    },
-  ) {
-    if (!ctx.hasUI) {
-      ctx.ui.notify("bwrap mode cannot be changed without an interactive UI", "warning");
-      return;
-    }
-    setMode(mode);
-
-    ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${mode}`));
-
-    notifyMode(ctx, mode);
-    pi.sendMessage({
-      customType: "info",
-      content: `Bwrap sandbox mode changed to "${mode}".`,
-      display: true,
-    });
-  }
-
-  pi.registerCommand("bwrap-allow-all", {
-    description: BWRAP_ALLOW_ALL_SPEC.description,
-    handler: (args, ctx) =>
-      runBwrapCommand(BWRAP_ALLOW_ALL_SPEC, args, ctx, (c) => switchMode("allow-all", c)),
-  });
-
-  pi.registerCommand("bwrap-workspace-write", {
-    description: BWRAP_WORKSPACE_WRITE_SPEC.description,
-    handler: (args, ctx) =>
-      runBwrapCommand(BWRAP_WORKSPACE_WRITE_SPEC, args, ctx, (c) =>
-        switchMode("workspace-write", c),
-      ),
-  });
-
-  pi.registerCommand("bwrap-allow-net", {
-    description: BWRAP_ALLOW_NET_SPEC.description,
-    handler: (args, ctx) =>
-      runBwrapCommand(BWRAP_ALLOW_NET_SPEC, args, ctx, (c) => switchMode("allow-net", c)),
-  });
-
-  pi.registerCommand("bwrap-readonly", {
-    description: BWRAP_READONLY_SPEC.description,
-    handler: (args, ctx) =>
-      runBwrapCommand(BWRAP_READONLY_SPEC, args, ctx, (c) => switchMode("readonly", c)),
-  });
 }