@turmind/halo 1.3.4-c3090bf → 1.4.0

package/dist/index.js

@@ -513,12 +513,12 @@ function generalSection() {
       { key: "compact.max_summary_input", type: "int", globalOnly: true, description: "Max chars fed into local truncation fallback", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u7684\u603B\u8F93\u5165\u5B57\u7B26\u4E0A\u9650", default: "15000" },
       { key: "compact.max_message_slice", type: "int", globalOnly: true, description: "Max chars kept per old message during local truncation", description_zh: "\u672C\u5730\u622A\u65AD\u515C\u5E95\u65F6\u6BCF\u6761\u65E7\u6D88\u606F\u4FDD\u7559\u7684\u6700\u5927\u5B57\u7B26\u6570", default: "800" },
       { key: "compact.summarize_timeout_sec", type: "int", globalOnly: true, description: "LLM summarization timeout (seconds)", description_zh: "LLM \u6458\u8981\u8D85\u65F6\u65F6\u95F4\uFF08\u79D2\uFF09", default: "300" },
-      // sandbox (Linux bwrap only) — global-only: these define the security
+      // sandbox (Linux bwrap / macOS sandbox-exec) — global-only: these define the security
       // boundary agents run inside; a workspace overriding them could lift
       // its own sandbox constraints.
-      { key: "sandbox.hidden_dirs", globalOnly: true, description: "Comma-separated dirs hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 bwrap tmpfs \u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs" },
-      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs bind-mounted read-write inside the bwrap sandbox (Linux only) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u5728 bwrap \u6C99\u7BB1\u5185\u4EE5\u53EF\u5199\u65B9\u5F0F\u6302\u8F7D\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
-      { key: "sandbox.hidden_files", globalOnly: true, description: "Comma-separated files hidden by bwrap (Linux only)", description_zh: "\u901A\u8FC7 /dev/null bind \u9690\u85CF\u7684\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0C\u4EC5 Linux\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm,~/.halo/global/runs.db,~/.halo/global/runs.db-wal,~/.halo/global/runs.db-shm" },
+      { key: "sandbox.hidden_dirs", globalOnly: true, description: "Comma-separated dirs hidden from workspace/readonly sessions (Linux bwrap / macOS sandbox-exec)", description_zh: "\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux bwrap / macOS sandbox-exec\uFF09", default: "~/.halo/secrets,~/.aws,~/.ssh,~/.gnupg,~/.docker,~/.config/gh,~/.halo/global/internal-sessions,~/.halo/global/logs" },
+      { key: "sandbox.writable_dirs", globalOnly: true, description: "Comma-separated dirs writable inside the sandbox besides the workspace (Linux / macOS) \u2014 for external CLIs that keep local state, e.g. ~/.kiro,~/.local/share/kiro-cli. Not applied to readonly sessions.", description_zh: "\u9664 workspace \u5916\u5728\u6C99\u7BB1\u5185\u53EF\u5199\u7684\u76EE\u5F55\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09\u2014\u2014\u7ED9\u9700\u8981\u672C\u5730\u72B6\u6001\u7684\u5916\u90E8 CLI \u7528\uFF0C\u5982 ~/.kiro,~/.local/share/kiro-cli\u3002readonly \u4F1A\u8BDD\u4E0D\u751F\u6548\u3002", default: "" },
+      { key: "sandbox.hidden_files", globalOnly: true, description: "Comma-separated files hidden from workspace/readonly sessions \u2014 read as empty (Linux / macOS)", description_zh: "\u5BF9 workspace/readonly \u4F1A\u8BDD\u9690\u85CF\u7684\u6587\u4EF6\uFF0C\u8BFB\u5230\u7684\u662F\u7A7A\u6587\u4EF6\uFF08\u9017\u53F7\u5206\u9694\uFF0CLinux / macOS\uFF09", default: "~/.npmrc,~/.bash_history,~/.gitconfig,~/.git-credentials,~/.netrc,~/.halo/global/evo.db,~/.halo/global/evo.db-wal,~/.halo/global/evo.db-shm,~/.halo/global/cron.db,~/.halo/global/cron.db-wal,~/.halo/global/cron.db-shm,~/.halo/global/runs.db,~/.halo/global/runs.db-wal,~/.halo/global/runs.db-shm" },
       // logging
       { key: "logging.level", type: "enum", options: ["debug", "info", "warn", "error"], globalOnly: true, description: "Log level", description_zh: "\u65E5\u5FD7\u7EA7\u522B", default: "warn" },
       // observability (OpenTelemetry). Read once at boot by observability/otel.ts
@@ -2130,6 +2130,7 @@ __export(init_exports, {
   describeOptionalSkill: () => describeOptionalSkill,
   ensureHaloHome: () => ensureHaloHome,
   ensureWorkspaceHalo: () => ensureWorkspaceHalo,
+  hasWorkspaceHalo: () => hasWorkspaceHalo,
   listOptionalSkillIds: () => listOptionalSkillIds,
   mergeAgentYaml: () => mergeAgentYaml,
   readInstalledOptionalSkills: () => readInstalledOptionalSkills,
@@ -2458,6 +2459,9 @@ function ensureHaloHome(haloHome2) {
   } catch {
   }
 }
+function hasWorkspaceHalo(root) {
+  return fs7.existsSync(path8.join(root, ".halo"));
+}
 function ensureWorkspaceHalo(workspaceRoot) {
   if (!fs7.existsSync(workspaceRoot)) {
     throw new Error(`Workspace root does not exist: ${workspaceRoot}`);
@@ -2497,7 +2501,7 @@ var init_init = __esm({
       path8.resolve(__dirname, "..", "bundled-docs"),
       path8.resolve(__dirname, "..", "..", "..", ".halo", "docs")
     ];
-    TEMPLATE_VERSION = 60;
+    TEMPLATE_VERSION = 65;
     VERSION_FILE = ".template-version";
     SKIP_NAMES = /* @__PURE__ */ new Set([".DS_Store", "schema.sql", "__pycache__", ".pytest_cache"]);
     BUILTIN_AGENT_IDS = /* @__PURE__ */ new Set([
@@ -9491,7 +9495,7 @@ import { exec, execFile, spawn as spawn2 } from "node:child_process";
 import { promisify } from "node:util";
 import path25 from "node:path";
 import { homedir as homedir10 } from "node:os";
-import { existsSync, realpathSync as realpathSync2 } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, realpathSync as realpathSync2, rmSync, writeFileSync } from "node:fs";
 function decodeWinOutput(buf) {
   try {
     return new TextDecoder("utf-8", { fatal: true }).decode(buf);
@@ -9525,7 +9529,7 @@ async function bwrapExec(args, opts) {
 }
 function spawnGroupExec(command, opts) {
   return new Promise((resolve2, reject) => {
-    const child = spawn2(command, { shell: true, detached: true, cwd: opts.cwd, env: cleanChildEnv() });
+    const child = opts.argv ? spawn2(opts.argv[0], opts.argv.slice(1), { detached: true, cwd: opts.cwd, env: opts.env ?? cleanChildEnv() }) : spawn2(command, { shell: true, detached: true, cwd: opts.cwd, env: cleanChildEnv() });
     let stdout = "";
     let stderr = "";
     let killReason = null;
@@ -9637,12 +9641,68 @@ async function isBwrapAvailable() {
     return false;
   }
 }
-function isBwrapCached() {
-  return _bwrapAvailable === true;
+async function isSeatbeltAvailable() {
+  if (process.platform !== "darwin")
+    return false;
+  if (_seatbeltAvailable !== null)
+    return _seatbeltAvailable;
+  try {
+    await execFileAsync(SANDBOX_EXEC, ["-p", "(version 1)(allow default)", "/usr/bin/true"], { timeout: 5e3 });
+    _seatbeltAvailable = true;
+  } catch (err) {
+    console.warn(`[Sandbox] sandbox-exec probe failed (${String(err.message).split("\n")[0]}) \u2014 non-full shell_exec unavailable`);
+    _seatbeltAvailable = false;
+  }
+  return _seatbeltAvailable;
+}
+function getSandboxBackend() {
+  if (_bwrapAvailable === true)
+    return "bwrap";
+  if (_seatbeltAvailable === true)
+    return "seatbelt";
+  return null;
+}
+async function loadGitIdentity() {
+  const read = async (key) => {
+    try {
+      return String((await execFileAsync("git", ["config", "--global", key], { timeout: 3e3 })).stdout).trim();
+    } catch {
+      return "";
+    }
+  };
+  const [name, email] = await Promise.all([read("user.name"), read("user.email")]);
+  _gitIdentity = { name, email };
+}
+function gitIdentityEnv() {
+  const env = {};
+  if (_gitIdentity.name) {
+    env.GIT_AUTHOR_NAME = _gitIdentity.name;
+    env.GIT_COMMITTER_NAME = _gitIdentity.name;
+  }
+  if (_gitIdentity.email) {
+    env.GIT_AUTHOR_EMAIL = _gitIdentity.email;
+    env.GIT_COMMITTER_EMAIL = _gitIdentity.email;
+  }
+  return env;
 }
 async function initBwrapCheck() {
+  await loadGitIdentity();
+  if (process.platform === "darwin")
+    return isSeatbeltAvailable();
   return isBwrapAvailable();
 }
+function ensureEmptyMaskFile() {
+  try {
+    const st = lstatSync(EMPTY_MASK_FILE);
+    if (st.isFile() && st.size === 0)
+      return EMPTY_MASK_FILE;
+    rmSync(EMPTY_MASK_FILE, { recursive: true, force: true });
+  } catch {
+  }
+  mkdirSync(HALO_HOME3, { recursive: true });
+  writeFileSync(EMPTY_MASK_FILE, "");
+  return EMPTY_MASK_FILE;
+}
 function expandTilde(p) {
   return p.startsWith("~/") ? path25.join(HOME, p.slice(2)) : p;
 }
@@ -9650,6 +9710,20 @@ function setSandboxHiddenPaths(dirs, files, writableDirs = []) {
   _hiddenDirs = dirs;
   _hiddenFiles = files;
   _writableDirs = writableDirs;
+  _resolvedLists = null;
+}
+function resolvedLists() {
+  if (_resolvedLists)
+    return _resolvedLists;
+  const both = (raws) => [...new Set(raws.flatMap((raw) => {
+    const p = path25.resolve(expandTilde(raw));
+    return [p, realpathBounded(p)];
+  }))];
+  _resolvedLists = { hiddenDirs: both(_hiddenDirs), hiddenFiles: both(_hiddenFiles), writableDirs: both(_writableDirs) };
+  return _resolvedLists;
+}
+function isUnder(p, dir) {
+  return p === dir || p.startsWith(dir.endsWith("/") ? dir : dir + "/");
 }
 function buildBwrapArgs(opts) {
   const args = [];
@@ -9660,10 +9734,11 @@ function buildBwrapArgs(opts) {
     if (existsSync(dir))
       args.push("--tmpfs", dir);
   }
+  const emptyFile = ensureEmptyMaskFile();
   for (const raw of _hiddenFiles) {
     const file = expandTilde(raw);
     if (existsSync(file))
-      args.push("--ro-bind", "/dev/null", file);
+      args.push("--ro-bind", emptyFile, file);
   }
   if (opts.accessLevel !== "readonly") {
     args.push("--bind", opts.workspaceRoot, opts.workspaceRoot);
@@ -9683,7 +9758,7 @@ function buildBwrapArgs(opts) {
   for (const rel of WORKSPACE_HIDDEN_FILES) {
     const file = path25.join(opts.workspaceRoot, rel);
     if (existsSync(file))
-      args.push("--ro-bind", "/dev/null", file);
+      args.push("--ro-bind", emptyFile, file);
   }
   args.push("--proc", "/proc");
   args.push("--dev", "/dev");
@@ -9691,6 +9766,8 @@ function buildBwrapArgs(opts) {
   args.push("--setenv", "PATH", `${HOME}/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin`);
   args.push("--setenv", "HOME", HOME);
   args.push("--setenv", "TERM", "xterm-256color");
+  for (const [k, v] of Object.entries(gitIdentityEnv()))
+    args.push("--setenv", k, v);
   args.push("--die-with-parent");
   return args;
 }
@@ -9718,31 +9795,57 @@ function assertPathAllowed(filePath, opts, write = false) {
     return path25.resolve(filePath);
   const resolved = realpathBounded(filePath);
   const wsRoot = realpathBounded(opts.workspaceRoot);
-  if (resolved === wsRoot || resolved.startsWith(wsRoot + "/")) {
-    if (isHiddenWorkspacePath(resolved, wsRoot)) {
-      throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
-    }
-    if (write && opts.accessLevel === "readonly") {
-      throw new Error(`Access denied: readonly session cannot write to "${filePath}"`);
-    }
-    return resolved;
+  const inWorkspace = isUnder(resolved, wsRoot);
+  if (inWorkspace && isHiddenWorkspacePath(resolved, wsRoot) || isHiddenHostPath(resolved)) {
+    throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
   }
-  if (!write && (resolved === GLOBAL_DIR || resolved.startsWith(GLOBAL_DIR + "/")) && !isHiddenGlobalPath(resolved)) {
+  if (!write)
     return resolved;
+  if (opts.accessLevel === "readonly") {
+    throw new Error(`Access denied: readonly session cannot write to "${filePath}"`);
   }
+  if (inWorkspace || resolvedLists().writableDirs.some((d) => isUnder(resolved, d)))
+    return resolved;
   throw new Error(`Access denied: "${filePath}" is outside the allowed sandbox paths`);
 }
-function isHiddenGlobalPath(resolved) {
-  for (const raw of _hiddenFiles) {
-    if (resolved === expandTilde(raw))
-      return true;
-  }
-  for (const raw of _hiddenDirs) {
-    const dir = expandTilde(raw);
-    if (resolved === dir || resolved.startsWith(dir + "/"))
-      return true;
+function isHiddenHostPath(resolved) {
+  const { hiddenDirs, hiddenFiles } = resolvedLists();
+  return hiddenFiles.includes(resolved) || hiddenDirs.some((d) => isUnder(resolved, d));
+}
+function buildSeatbeltProfile(opts) {
+  const q = (p) => `"${p.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  const wsRoot = realpathBounded(opts.workspaceRoot);
+  const lists = resolvedLists();
+  const writable = ["/private/tmp", "/private/var/folders", "/dev"];
+  if (opts.accessLevel !== "readonly")
+    writable.unshift(wsRoot, ...lists.writableDirs);
+  const hiddenDirs = [...lists.hiddenDirs, ...WORKSPACE_HIDDEN_DIRS.map((rel) => path25.join(wsRoot, rel))];
+  const hiddenFiles = [...lists.hiddenFiles, ...WORKSPACE_HIDDEN_FILES.map((rel) => path25.join(wsRoot, rel))];
+  return [
+    "(version 1)",
+    "(allow default)",
+    "(deny file-write*)",
+    `(allow file-write* ${writable.map((p) => `(subpath ${q(p)})`).join(" ")})`,
+    `(deny file-read* file-write* ${[
+      ...hiddenDirs.map((p) => `(subpath ${q(p)})`),
+      ...hiddenFiles.map((p) => `(literal ${q(p)})`)
+    ].join(" ")})`
+  ].join("\n");
+}
+function seatbeltEnv() {
+  const env = {
+    PATH: `${HOME}/.local/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/usr/local/sbin:/usr/bin:/bin:/usr/sbin:/sbin`,
+    HOME,
+    TERM: "xterm-256color",
+    GIT_CONFIG_GLOBAL: "/dev/null",
+    NPM_CONFIG_USERCONFIG: "/dev/null",
+    ...gitIdentityEnv()
+  };
+  for (const k of ["TMPDIR", "USER", "LOGNAME", "LANG", "LC_ALL"]) {
+    if (process.env[k])
+      env[k] = process.env[k];
   }
-  return false;
+  return env;
 }
 function isHiddenWorkspacePath(resolved, wsRoot) {
   for (const rel of WORKSPACE_HIDDEN_FILES) {
@@ -9766,8 +9869,173 @@ function buildWriteScriptArgs(filePath, content) {
 function buildReaddirScriptArgs(dirPath) {
   return ["bash", "-c", 'ls -1ap "$1"', "bash", dirPath];
 }
+function shellSegments(command) {
+  const segments = [];
+  let words = [];
+  let cur = "";
+  let inWord = false;
+  let quote = null;
+  const heredocs = [];
+  const endWord = () => {
+    if (inWord)
+      words.push(cur);
+    cur = "";
+    inWord = false;
+  };
+  const endSegment = () => {
+    endWord();
+    if (words.length)
+      segments.push(words);
+    words = [];
+  };
+  for (let i = 0; i < command.length; i++) {
+    const c = command[i];
+    if (quote) {
+      if (c === quote)
+        quote = null;
+      else if (c === "\\" && quote === '"' && i + 1 < command.length)
+        cur += command[++i];
+      else
+        cur += c;
+      continue;
+    }
+    if (c === "<" && command[i + 1] === "<" && command[i + 2] !== "<") {
+      const m = /^<<(-?)\s*(['"]?)([A-Za-z0-9_.-]+)\2/.exec(command.slice(i));
+      if (m) {
+        endWord();
+        heredocs.push({ delim: m[3], dash: m[1] === "-" });
+        i += m[0].length - 1;
+        continue;
+      }
+    }
+    if (c === "\n" && heredocs.length) {
+      endSegment();
+      let pos = i + 1;
+      for (const h of heredocs.splice(0)) {
+        while (pos < command.length) {
+          const eol = command.indexOf("\n", pos);
+          const line = command.slice(pos, eol === -1 ? command.length : eol);
+          pos = eol === -1 ? command.length : eol + 1;
+          if ((h.dash ? line.replace(/^\t+/, "") : line) === h.delim)
+            break;
+        }
+      }
+      i = pos - 1;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      inWord = true;
+    } else if (c === "\\" && command[i + 1] === "\n")
+      i++;
+    else if (c === "\\" && i + 1 < command.length) {
+      cur += command[++i];
+      inWord = true;
+    } else if (c === ";" || c === "&" || c === "|" || c === "\n")
+      endSegment();
+    else if (c === " " || c === "	" || c === "\r")
+      endWord();
+    else {
+      cur += c;
+      inWord = true;
+    }
+  }
+  endSegment();
+  return segments;
+}
+function expandRmWord(word, cwd) {
+  return word.replace(/^~(?=\/|$)/, HOME).replace(/\$\{HOME\}|\$HOME\b/g, HOME).replace(/\$\{PWD\}|\$PWD\b|\$\(pwd\)|`pwd`/g, cwd).replace(/\$\{[^}]*\}|\$\([^)]*\)|`[^`]*`|\$[A-Za-z_][A-Za-z0-9_]*|\$\d/g, "");
+}
+function stripSubshellClose(word) {
+  let w = word;
+  while (w.endsWith(")") && (w.match(/\(/g)?.length ?? 0) < (w.match(/\)/g)?.length ?? 0))
+    w = w.slice(0, -1);
+  return w;
+}
+function rmProtectedReason(target, wsRoot) {
+  if (target === "/")
+    return "the filesystem root";
+  if (isUnder(HOME, target))
+    return "the home directory or a parent of it";
+  if (isUnder(HALO_HOME3, target))
+    return "~/.halo or a parent of it";
+  if (isUnder(wsRoot, target))
+    return "the workspace root or a parent of it";
+  if (RM_EXACT_DIRS.includes(target))
+    return "a system directory";
+  for (const d of RM_SYSTEM_DIRS) {
+    if (target === d || path25.dirname(target) === d)
+      return "a system directory";
+  }
+  return null;
+}
+function assertRmSafe(command, workspaceRoot) {
+  const wsRoot = path25.resolve(workspaceRoot);
+  let cwd = wsRoot;
+  for (const words of shellSegments(command)) {
+    let i = 0;
+    let cmd = "";
+    for (; i < words.length; i++) {
+      cmd = words[i].replace(/^[({!]+/, "");
+      if (!cmd || /^[A-Za-z_][A-Za-z0-9_]*=/.test(cmd))
+        continue;
+      if (RM_WRAPPERS.has(path25.basename(cmd))) {
+        while (i + 1 < words.length && words[i + 1].startsWith("-"))
+          i++;
+        continue;
+      }
+      break;
+    }
+    if (i >= words.length)
+      continue;
+    if (cmd === "cd") {
+      const dest = words[i + 1];
+      if (dest === void 0)
+        cwd = HOME;
+      else if (dest !== "-")
+        cwd = path25.resolve(cwd, expandRmWord(stripSubshellClose(dest), cwd) || ".");
+      continue;
+    }
+    const base = path25.basename(cmd);
+    if (base !== "rm" && base !== "rmdir")
+      continue;
+    let optionsDone = false;
+    for (let j = i + 1; j < words.length; j++) {
+      const raw = words[j];
+      if (!optionsDone && raw === "--") {
+        optionsDone = true;
+        continue;
+      }
+      if (!optionsDone && raw.startsWith("-"))
+        continue;
+      if (/^(\d*|&)?[<>]/.test(raw)) {
+        if (/^(\d*|&)?[<>]+&?$/.test(raw))
+          j++;
+        continue;
+      }
+      const word = expandRmWord(stripSubshellClose(raw), cwd);
+      if (!word)
+        continue;
+      const abs = path25.resolve(cwd, word);
+      const parts = abs.split("/");
+      const globAt = parts.findIndex((p) => /[*?[]/.test(p));
+      let target = abs;
+      if (globAt !== -1) {
+        if (!/^[.*?]+$/.test(parts[globAt]))
+          continue;
+        target = parts.slice(0, globAt).join("/") || "/";
+      }
+      const reason = rmProtectedReason(target, wsRoot);
+      if (reason) {
+        throw new Error(`[Sandbox] rm blocked: "${raw}" resolves to ${target}, which is ${reason}. Name the specific files or subdirectories to delete instead.`);
+      }
+    }
+  }
+}
 async function sandboxExec(command, opts) {
   opts = normalizeOptsForPlatform(opts);
+  if (process.platform !== "win32")
+    assertRmSafe(command, opts.workspaceRoot);
   if (opts.accessLevel === "full") {
     if (process.platform === "win32") {
       const result = await execAsync(`chcp 65001 >nul 2>&1 & ${command}`, {
@@ -9789,10 +10057,21 @@ async function sandboxExec(command, opts) {
       signal: opts.signal
     });
   }
-  const bwrapOk = await isBwrapAvailable();
-  if (!bwrapOk) {
-    throw new Error("Access denied: shell_exec requires bubblewrap (bwrap) for non-full access levels. Install with: apt install bubblewrap");
+  if (process.platform === "darwin") {
+    if (!await isSeatbeltAvailable())
+      throw new Error(NO_SANDBOX_MSG);
+    return spawnGroupExec(command, {
+      cwd: opts.workspaceRoot,
+      timeout: opts.timeout,
+      maxBuffer: opts.maxBuffer,
+      signal: opts.signal,
+      argv: [SANDBOX_EXEC, "-p", buildSeatbeltProfile(opts), ...buildExecScriptArgs(opts.workspaceRoot, command)],
+      env: seatbeltEnv()
+    });
   }
+  const bwrapOk = await isBwrapAvailable();
+  if (!bwrapOk)
+    throw new Error(NO_SANDBOX_MSG);
   const bwrapArgs = buildBwrapArgs(opts);
   return bwrapExec([...bwrapArgs, "--", ...buildExecScriptArgs(opts.workspaceRoot, command)], {
     timeout: opts.timeout,
@@ -9959,7 +10238,7 @@ async function sandboxReaddir(dirPath, opts) {
     return { name: isDir ? name.slice(0, -1) : name, isDirectory: isDir };
   });
 }
-var execAsync, execFileAsync, HOME, HALO_HOME3, GLOBAL_DIR, KILL_GRACE_MS, _bwrapAvailable, DEFAULT_HIDDEN_DIRS, DEFAULT_HIDDEN_FILES, WORKSPACE_HIDDEN_DIRS, WORKSPACE_HIDDEN_FILES, _hiddenDirs, _hiddenFiles, _writableDirs;
+var execAsync, execFileAsync, HOME, HALO_HOME3, KILL_GRACE_MS, _bwrapAvailable, SANDBOX_EXEC, _seatbeltAvailable, _gitIdentity, EMPTY_MASK_FILE, DEFAULT_HIDDEN_DIRS, DEFAULT_HIDDEN_FILES, WORKSPACE_HIDDEN_DIRS, WORKSPACE_HIDDEN_FILES, _hiddenDirs, _hiddenFiles, _writableDirs, _resolvedLists, RM_SYSTEM_DIRS, RM_EXACT_DIRS, RM_WRAPPERS, NO_SANDBOX_MSG;
 var init_sandbox = __esm({
   "../server/dist/tools/sandbox.js"() {
     "use strict";
@@ -9968,9 +10247,12 @@ var init_sandbox = __esm({
     execFileAsync = promisify(execFile);
     HOME = homedir10();
     HALO_HOME3 = path25.join(HOME, ".halo");
-    GLOBAL_DIR = path25.join(HALO_HOME3, "global");
     KILL_GRACE_MS = 2e3;
     _bwrapAvailable = null;
+    SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+    _seatbeltAvailable = null;
+    _gitIdentity = { name: "", email: "" };
+    EMPTY_MASK_FILE = path25.join(HALO_HOME3, ".sandbox-empty");
     DEFAULT_HIDDEN_DIRS = [
       "~/.halo/secrets",
       "~/.aws",
@@ -10011,6 +10293,38 @@ var init_sandbox = __esm({
     _hiddenDirs = DEFAULT_HIDDEN_DIRS;
     _hiddenFiles = DEFAULT_HIDDEN_FILES;
     _writableDirs = [];
+    _resolvedLists = null;
+    RM_SYSTEM_DIRS = [
+      "/bin",
+      "/boot",
+      "/dev",
+      "/etc",
+      "/home",
+      "/lib",
+      "/lib32",
+      "/lib64",
+      "/libx32",
+      "/media",
+      "/mnt",
+      "/opt",
+      "/proc",
+      "/run",
+      "/sbin",
+      "/snap",
+      "/srv",
+      "/sys",
+      "/usr",
+      "/var",
+      "/Applications",
+      "/Library",
+      "/System",
+      "/Users",
+      "/Volumes",
+      "/private"
+    ];
+    RM_EXACT_DIRS = ["/tmp", "/private/tmp", "/root"];
+    RM_WRAPPERS = /* @__PURE__ */ new Set(["sudo", "command", "env", "xargs", "nohup", "time", "exec", "nice", "if", "then", "else", "elif", "do", "while", "until"]);
+    NO_SANDBOX_MSG = "Access denied: shell_exec at workspace/readonly access needs an OS sandbox (bubblewrap on Linux, sandbox-exec on macOS) and none works on this host. Switch the session to Full, or on Linux install bubblewrap (apt install bubblewrap).";
   }
 });
 
@@ -10530,10 +10844,13 @@ Error: old_string appears more than once in ${input.path}. Either expand it with
 STDERR: ${stderr}` : "")).trim() || "(no output)");
       } catch (err) {
         const error = err;
-        return mask(`${TOOL_ERROR_MARKER}
-Command failed: ${error.message}
+        const out = `${error.message}
 ${error.stdout ?? ""}
-${error.stderr ?? ""}`);
+${error.stderr ?? ""}`;
+        const hint = accessLevel !== "full" && SANDBOX_DENIED_RE.test(out) ? `
+[Sandbox] This session runs at "${accessLevel}" access: writes are limited to the workspace${accessLevel === "readonly" ? " (readonly: nowhere)" : ""} and /tmp is discarded after each command. If the command needs more, ask the user to switch the access level to Full in the chat input box.` : "";
+        return mask(`${TOOL_ERROR_MARKER}
+Command failed: ${out}${hint}`);
       }
     }
   };
@@ -10698,7 +11015,7 @@ Error: ${error.message}`;
   };
   const visionTools = supportsVision ? [viewImage] : [];
   const allTools = [fileRead, ...visionTools, fileWrite, fileEdit, fileList, shellExec, grepTool, globTool, webFetch];
-  if (accessLevel === "readonly" && !isBwrapCached()) {
+  if (accessLevel === "readonly" && getSandboxBackend() === null) {
     return [fileRead, ...visionTools, fileList, grepTool, globTool];
   }
   return allTools;
@@ -10731,7 +11048,7 @@ function imageDimensions(buf, mediaType) {
   }
   return null;
 }
-var SKIP_DIRS, SKIP_HALO_SUBDIRS, GLOB_MAX_RESULTS, HOME2, PARAMS_PATTERN, ENV_PATTERN3;
+var SKIP_DIRS, SKIP_HALO_SUBDIRS, GLOB_MAX_RESULTS, SANDBOX_DENIED_RE, HOME2, PARAMS_PATTERN, ENV_PATTERN3;
 var init_workspace_tools = __esm({
   "../server/dist/tools/workspace-tools.js"() {
     "use strict";
@@ -10744,6 +11061,7 @@ var init_workspace_tools = __esm({
     SKIP_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", ".next", "dist"]);
     SKIP_HALO_SUBDIRS = /* @__PURE__ */ new Set(["sessions", "logs", "evo", "tmp", "assets", "canvas"]);
     GLOB_MAX_RESULTS = 5e3;
+    SANDBOX_DENIED_RE = /Read-only file system|Operation not permitted|Permission denied|EROFS|EPERM/;
     HOME2 = homedir11();
     PARAMS_PATTERN = /\{\{\s*([\w-]+)\.params\.([\w-][\w.-]*)\s*\}\}/g;
     ENV_PATTERN3 = /<<([A-Z_][A-Z0-9_]*)>>/g;
@@ -11487,7 +11805,7 @@ async function initObservability() {
     return true;
   }
   const { registerSdk: registerSdk2 } = await Promise.resolve().then(() => (init_otel_sdk(), otel_sdk_exports));
-  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.3.4-c3090bf");
+  providers = registerSdk2(process.env.OTEL_SERVICE_NAME, "1.4.0");
   console.log(`[Observability] OTLP export \u2192 ${process.env.OTEL_EXPORTER_OTLP_ENDPOINT} (service.name=${process.env.OTEL_SERVICE_NAME}, capture_content=${config.observability.captureContent})`);
   return true;
 }
@@ -12483,6 +12801,24 @@ var init_session_manager = __esm({
       dropUIState(sessionId) {
         this.uiStore.dropUIState(sessionId);
       }
+      /** Another process (a cron `halo cli` child) just wrote this root session's
+       *  files. Drop the idle in-memory copies — the tree's AgentSessions (raw
+       *  history, loaded by any view via ensureSession and never evicted while
+       *  idle) and the root's UIState — WITHOUT saving, so the next view/message
+       *  re-reads disk instead of overwriting the other writer's turn with this
+       *  process's stale snapshot. Returns false (and drops nothing) while any
+       *  turn/compact in the tree is in flight: live state can't be discarded,
+       *  and the two writers race — the accepted cost of sharing a session. */
+      forgetExternalWrite(rootId) {
+        if (this.hasActiveWorkInTree(rootId))
+          return false;
+        for (const id of [...this.sessions.keys()]) {
+          if (id === rootId || id.startsWith(`${rootId}>`))
+            this.sessions.delete(id);
+        }
+        this.uiStore.dropUIState(rootId);
+        return true;
+      }
       // ── Loop detection ──────────────────────────────────────────────────
       static LOOP_EXEMPT_TOOLS = /* @__PURE__ */ new Set([
         "session_list",
@@ -19077,7 +19413,7 @@ function createAgentConfigRoutes() {
       if (wsIds.has(a.id))
         a.overridden = true;
     }
-    const disabledSet = projectId ? getDisabledSet(getWorkspaceDb(projectId).db, "agent") : /* @__PURE__ */ new Set();
+    const disabledSet = projectId && hasWorkspaceHalo(projectId) ? getDisabledSet(getWorkspaceDb(projectId).db, "agent") : /* @__PURE__ */ new Set();
     const allAgents = [...globalAgents, ...workspaceAgents];
     for (const a of allAgents) {
       a.disabled = disabledSet.has(`${a.scope}:${a.id}`);
@@ -19427,6 +19763,7 @@ var init_agent_configs = __esm({
     init_md_loader();
     init_config();
     init_db();
+    init_init();
     init_workspace_path();
     init_mtime_cache();
     _cachedTools = null;
@@ -19451,7 +19788,7 @@ function defaultSkillSettings() {
         "",
         "global.anthropic.claude-sonnet-4-6",
         "global.anthropic.claude-haiku-4-5-20251001",
-        "global.anthropic.claude-opus-4-6"
+        "global.anthropic.claude-opus-5-5"
       ]
     }
   };
@@ -20498,6 +20835,8 @@ function createSessionRoutes(smRegistry) {
       return c.json({ error: "session manager not initialized" }, 500);
     if (!projectId)
       return c.json({ error: "projectId required" }, 400);
+    if (!hasWorkspaceHalo(projectId))
+      return c.json({ sessions: [], nextCursor: null });
     const sm = smRegistry.getOrCreate(projectId);
     let parentId;
     if (parentIdParam === void 0)
@@ -20647,6 +20986,7 @@ var init_sessions = __esm({
     init_goal_mode();
     init_broadcast();
     init_workspace_path();
+    init_init();
     msgCounter2 = 0;
   }
 });
@@ -23618,7 +23958,8 @@ ${msg.message}` : markers.join("\n");
       rememberChat(msg);
       ackChat(msg);
       console.debug(`[WS] Chat: session=${msg.sessionId}, project=${msg.projectId}, agent=${msg.agentId ?? client2.agentId}`);
-      sm.sendUserMessage(sid, msg.message, msg.images).catch((err) => {
+      const accessLevel = msg.accessLevel === void 0 ? void 0 : msg.accessLevel === "full" || getSandboxBackend() === null ? null : msg.accessLevel;
+      sm.sendUserMessage(sid, msg.message, msg.images, accessLevel).catch((err) => {
         console.debug(`[WS] Chat error: ${err instanceof Error ? err.message : String(err)}`);
         sendJson(ws, { type: "error", error: err instanceof Error ? err.message : String(err) });
         saveSession(client2);
@@ -23678,7 +24019,7 @@ ${msg.message}` : markers.join("\n");
         const running = client2.sessionManager.isSessionRunning(client2.sessionId);
         const messages3 = state2 ? running ? [...state2.messageLog] : [...createSaveSnapshot(state2)] : [];
         const detachedSession = client2.sessionManager.getSessionById(client2.sessionId);
-        sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages3, sessionId: msg.sessionId, maxContextTokens: ctxConfig.maxTokens, agentId: detachedSession?.agentId, archiveCount: archiveCountFor(client2, client2.sessionId, detachedSession?.agentId) } });
+        sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages3, sessionId: msg.sessionId, maxContextTokens: ctxConfig.maxTokens, agentId: detachedSession?.agentId, archiveCount: archiveCountFor(client2, client2.sessionId, detachedSession?.agentId), accessLevel: detachedSession?.accessLevel ?? null } });
         if (state2 && state2.contextTokens > 0) {
           sendJson(ws, { type: "chat:usage", contextTokens: state2.contextTokens, outputTokens: state2.outputTokens });
         }
@@ -23722,12 +24063,14 @@ ${msg.message}` : markers.join("\n");
         }
       }
       let agentId;
+      let accessLevel;
       if (msg.sessionId && client2.sessionManager) {
         const existingSession = client2.sessionManager.getSessionById(msg.sessionId);
         if (existingSession) {
           client2.sessionId = msg.sessionId;
           client2.unsubscribeEvents = client2.sessionManager.registerEventListener(msg.sessionId, createEventListener(client2));
           agentId = existingSession.agentId;
+          accessLevel = existingSession.accessLevel ?? null;
         }
       }
       let maxContextTokens = config.model.maxContextTokens;
@@ -23739,7 +24082,7 @@ ${msg.message}` : markers.join("\n");
       }
       const state = getState(client2);
       const messages2 = state ? [...createSaveSnapshot(state)] : [];
-      sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages2, sessionId: msg.sessionId, maxContextTokens, agentId, archiveCount: msg.sessionId ? archiveCountFor(client2, msg.sessionId, agentId) : 0 } });
+      sendJson(ws, { type: "state:snapshot", snapshot: { recentMessages: messages2, sessionId: msg.sessionId, maxContextTokens, agentId, archiveCount: msg.sessionId ? archiveCountFor(client2, msg.sessionId, agentId) : 0, accessLevel } });
       if (state && state.contextTokens > 0) {
         sendJson(ws, { type: "chat:usage", contextTokens: state.contextTokens, outputTokens: state.outputTokens });
       }
@@ -23768,6 +24111,7 @@ var CLIENT_SILENCE_LIMIT_MS, detachedSessions;
 var init_handler2 = __esm({
   "../server/dist/ws/handler.js"() {
     "use strict";
+    init_sandbox();
     init_ui_log_builder();
     init_config();
     init_watcher_pool();
@@ -23838,6 +24182,10 @@ var init_cron_db = __esm({
        *  it. NULL = default 3600 (runner.ts CLI_TIMEOUT_SEC). Range 60–21600,
        *  enforced at the write points (REST routes / skill helper). */
       timeoutSec: integer5("timeout_sec"),
+      /** Root session id the cli runs in. NULL = the job's own `cron-<jobId>`
+       *  session. When it names an existing session the cli resumes it with that
+       *  session's own agent (`agentId` only applies when the session is new). */
+      sessionId: text5("session_id"),
       /** JSON array of `{channelType, accountId}` records. Cron output (final
        *  assistant text) is dispatched to each one. Empty array = log only. */
       targets: text5("targets").notNull().default("[]"),
@@ -23888,6 +24236,7 @@ CREATE TABLE IF NOT EXISTS cron_jobs (
   run_at          INTEGER,
   timezone        TEXT,
   timeout_sec     INTEGER,
+  session_id      TEXT,
   targets         TEXT NOT NULL DEFAULT '[]',
   enabled         INTEGER NOT NULL DEFAULT 1,
   last_run_status TEXT,
@@ -23923,7 +24272,9 @@ CREATE INDEX IF NOT EXISTS idx_cron_runs_status ON cron_runs(status);
         addColumnIfMissing(s, "cron_jobs", "run_at", "INTEGER");
         addColumnIfMissing(s, "cron_jobs", "timeout_sec", "INTEGER");
         addColumnIfMissing(s, "cron_runs", "pid", "INTEGER");
-      }
+      },
+      // v2: `session_id` — run the job in a chosen root session instead of cron-<jobId>.
+      (s) => addColumnIfMissing(s, "cron_jobs", "session_id", "TEXT")
     ];
     _cronDb = null;
   }
@@ -24048,14 +24399,30 @@ function killTreeHard(rootPid) {
     }
   }
 }
-function isCronCliProcess(pid, jobId) {
+function isCronCliProcess(pid, sessionId) {
   try {
     const args = execFileSync("ps", ["-p", String(pid), "-o", "args="], { encoding: "utf-8" });
-    return args.includes(`cron-${jobId}`);
+    return args.trim().split(/\s+/).includes(sessionId);
   } catch {
     return false;
   }
 }
+function effectiveSessionId(job) {
+  return job.sessionId ?? `cron-${job.id}`;
+}
+function sessionKeyFor(workspacePath, sessionId) {
+  let ws;
+  try {
+    ws = fs51.realpathSync(workspacePath);
+  } catch {
+    ws = path60.resolve(workspacePath);
+  }
+  return `${ws}
+${sessionId}`;
+}
+function setCronSessionRegistry(r) {
+  _sessionRegistry = r;
+}
 function logsDir() {
   return path60.join(homedir23(), ".halo", "global", "logs", "cron");
 }
@@ -24072,14 +24439,24 @@ function sweepOrphanRuns(opts) {
   const now = Date.now();
   for (const row of rows) {
     const { id: runId, jobId, pid } = row;
+    const job = db.select().from(cronJobs).where(eq14(cronJobs.id, jobId)).get();
+    const sessionId = effectiveSessionId(job ?? { id: jobId, sessionId: null });
+    const sessionKey = job ? sessionKeyFor(job.workspacePath, sessionId) : null;
     _inflight.add(jobId);
+    if (sessionKey)
+      _inflightSessions.add(sessionKey);
+    const release = () => {
+      _inflight.delete(jobId);
+      if (sessionKey)
+        _inflightSessions.delete(sessionKey);
+    };
     let needsKill = false;
     let disposition;
     if (process.platform === "win32") {
       disposition = pid == null ? "no pid recorded" : `pid ${pid} not killed (Windows: cannot verify process identity)`;
     } else if (pid == null) {
       disposition = "no pid recorded";
-    } else if (!isCronCliProcess(pid, jobId)) {
+    } else if (!isCronCliProcess(pid, sessionId)) {
       disposition = `pid ${pid} already dead (or pid reused by another process); not killed`;
     } else {
       needsKill = true;
@@ -24093,7 +24470,7 @@ function sweepOrphanRuns(opts) {
     broadcast({ type: "cron:run_changed", jobId, runId, status: "failed" });
     console.log(`[Cron] orphan sweep: run ${runId} (job ${jobId}) \u2014 ${disposition}`);
     if (!needsKill || pid == null) {
-      _inflight.delete(jobId);
+      release();
       continue;
     }
     try {
@@ -24101,11 +24478,11 @@ function sweepOrphanRuns(opts) {
     } catch {
     }
     const timer = setTimeout(() => {
-      if (isCronCliProcess(pid, jobId)) {
+      if (isCronCliProcess(pid, sessionId)) {
         console.log(`[Cron] orphan sweep: pid ${pid} (job ${jobId}) survived SIGTERM \u2014 SIGKILL tree`);
         killTreeHard(pid);
       }
-      _inflight.delete(jobId);
+      release();
     }, graceMs);
     timer.unref();
   }
@@ -24269,7 +24646,11 @@ async function runJob(jobId, triggerKind) {
   const startedAt = Date.now();
   const logPath = logPathFor(runId);
   fs51.mkdirSync(logsDir(), { recursive: true });
-  if (_inflight.has(jobId)) {
+  const sessionId = effectiveSessionId(job);
+  const sessionKey = sessionKeyFor(job.workspacePath, sessionId);
+  const host = _sessionRegistry?.peek(job.workspacePath);
+  const skipReason = _inflight.has(jobId) ? "previous run still in progress" : _inflightSessions.has(sessionKey) ? `session ${sessionId} busy: another cron run is in progress` : host?.hasActiveWorkInTree(sessionId) ? `session ${sessionId} busy: a turn is running in it` : null;
+  if (skipReason) {
     db.insert(cronRuns).values({
       id: runId,
       jobId,
@@ -24279,7 +24660,7 @@ async function runJob(jobId, triggerKind) {
       completedAt: startedAt,
       output: null,
       exitCode: null,
-      failureReason: "previous run still in progress",
+      failureReason: skipReason,
       logPath: null,
       dispatchResults: null
     }).run();
@@ -24287,6 +24668,7 @@ async function runJob(jobId, triggerKind) {
     return runId;
   }
   _inflight.add(jobId);
+  _inflightSessions.add(sessionKey);
   try {
     db.insert(cronRuns).values({
       id: runId,
@@ -24314,14 +24696,16 @@ async function runJob(jobId, triggerKind) {
       return runId;
     }
     const cli = resolveHaloCli();
-    const sessionId = `cron-${job.id}`;
     const args = ["cli", "-a", job.agentId, "-s", sessionId, "-w", job.workspacePath];
+    const accessLevel = readSessionAccessLevel(job.workspacePath, sessionId);
+    if (accessLevel)
+      args.push("--access", accessLevel);
     const [spawnBin, spawnArgs] = process.platform === "win32" && cli.endsWith(".cmd") ? ["cmd.exe", ["/c", cli, ...args]] : [cli, args];
     const timeoutSec = job.timeoutSec ?? CLI_TIMEOUT_SEC;
     const teeStream = fs51.createWriteStream(logPath, { flags: "a" });
     teeStream.write(`=== ${(/* @__PURE__ */ new Date()).toISOString()} cron run ${runId} job=${jobId} trigger=${triggerKind} ===
 `);
-    teeStream.write(`agent=${job.agentId} workspace=${job.workspacePath} schedule=${job.schedule}
+    teeStream.write(`agent=${job.agentId} session=${sessionId}${accessLevel ? ` access=${accessLevel}` : ""} workspace=${job.workspacePath} schedule=${job.schedule}
 `);
     teeStream.write(`prompt: ${job.userPrompt}
 
@@ -24393,6 +24777,10 @@ ${job.userPrompt}`);
         resolve2({ exitCode: 1 });
       });
     });
+    const hostAfter = _sessionRegistry?.peek(job.workspacePath);
+    if (hostAfter && !hostAfter.forgetExternalWrite(sessionId)) {
+      console.warn(`[Cron] ${jobId}: session ${sessionId} had a server-side turn running when the cli exited; one of the two turns may be missing from its history`);
+    }
     const trimmedOut = stdout.trim();
     let status;
     let failureReason = null;
@@ -24427,6 +24815,17 @@ ${job.userPrompt}`);
     return runId;
   } finally {
     _inflight.delete(jobId);
+    _inflightSessions.delete(sessionKey);
+  }
+}
+function readSessionAccessLevel(workspacePath, sessionId) {
+  try {
+    const row = getWorkspaceDb(workspacePath).db.select({ accessLevel: agentSessions.accessLevel }).from(agentSessions).where(eq14(agentSessions.id, sessionId)).get();
+    if (!row)
+      return null;
+    return row.accessLevel === "workspace" || row.accessLevel === "readonly" ? row.accessLevel : "full";
+  } catch {
+    return null;
   }
 }
 function finalize(runId, jobId, a) {
@@ -24508,12 +24907,14 @@ function pruneOldLogs() {
   const dbCutoff = Date.now() - 2 * LOG_RETENTION_DAYS * DAY_MS2;
   db.delete(cronRuns).where(lt5(cronRuns.startedAt, dbCutoff)).run();
 }
-var DAY_MS2, CLI_TIMEOUT_SEC, KILL_GRACE_SEC, UNATTENDED_PREAMBLE, RUNS_PER_JOB_KEEP, LOG_RETENTION_DAYS, _active, _inflight, _fingerprint, _daemonTimers, _lastCronDataVersion;
+var DAY_MS2, CLI_TIMEOUT_SEC, KILL_GRACE_SEC, UNATTENDED_PREAMBLE, RUNS_PER_JOB_KEEP, LOG_RETENTION_DAYS, _sessionRegistry, _active, _inflight, _inflightSessions, _fingerprint, _daemonTimers, _lastCronDataVersion;
 var init_runner = __esm({
   "../server/dist/cron/runner.js"() {
     "use strict";
     init_cron_db();
     init_raw_sqlite();
+    init_db();
+    init_schema();
     init_dispatcher();
     init_broadcast();
     init_child_env();
@@ -24523,8 +24924,10 @@ var init_runner = __esm({
     UNATTENDED_PREAMBLE = "[Unattended cron run \u2014 nobody will answer questions. Deliver the result directly; if genuinely blocked, state what's blocked in one line and stop.]";
     RUNS_PER_JOB_KEEP = 100;
     LOG_RETENTION_DAYS = 30;
+    _sessionRegistry = null;
     _active = /* @__PURE__ */ new Map();
     _inflight = /* @__PURE__ */ new Set();
+    _inflightSessions = /* @__PURE__ */ new Set();
     _fingerprint = /* @__PURE__ */ new Map();
     _daemonTimers = [];
     _lastCronDataVersion = null;
@@ -24556,6 +24959,19 @@ function validateTimeoutSec(v) {
   }
   return null;
 }
+function parseSessionId(v) {
+  if (v === void 0 || v === null)
+    return { sessionId: null };
+  if (typeof v !== "string")
+    return { error: "sessionId must be a string or null" };
+  const s = v.trim();
+  if (s.length === 0)
+    return { sessionId: null };
+  if (!SESSION_ID_RE.test(s)) {
+    return { error: 'sessionId must be a root session id (letters, digits, _ : - only; no ">" sub-session path)' };
+  }
+  return { sessionId: s };
+}
 function createCronRoutes() {
   const router = new Hono14();
   router.get("/cron/jobs", async (c) => {
@@ -24604,6 +25020,9 @@ function createCronRoutes() {
       if (err)
         return c.json({ error: err }, 400);
     }
+    const session = parseSessionId(body.sessionId);
+    if ("error" in session)
+      return c.json({ error: session.error }, 400);
     const id = newJobId();
     const now = Date.now();
     getCronDb().insert(cronJobs).values({
@@ -24616,6 +25035,7 @@ function createCronRoutes() {
       runAt: hasRunAt ? body.runAt : null,
       timezone: body.timezone ?? null,
       timeoutSec: body.timeoutSec ?? null,
+      sessionId: session.sessionId,
       targets: JSON.stringify(body.targets ?? []),
       enabled: body.enabled === false ? 0 : 1,
       lastRunStatus: null,
@@ -24657,6 +25077,9 @@ function createCronRoutes() {
       if (err)
         return c.json({ error: err }, 400);
     }
+    const session = parseSessionId(body.sessionId);
+    if ("error" in session)
+      return c.json({ error: session.error }, 400);
     const hasSchedule = typeof body.schedule === "string" && body.schedule.trim().length > 0;
     const hasRunAt = typeof body.runAt === "number";
     if (hasSchedule && hasRunAt) {
@@ -24686,6 +25109,8 @@ function createCronRoutes() {
       patch.timezone = body.timezone || null;
     if (body.timeoutSec !== void 0)
       patch.timeoutSec = body.timeoutSec;
+    if (body.sessionId !== void 0)
+      patch.sessionId = session.sessionId;
     if (body.targets !== void 0)
       patch.targets = JSON.stringify(body.targets);
     if (body.enabled !== void 0)
@@ -24801,7 +25226,7 @@ function computeNextRun(j) {
     return null;
   }
 }
-var TIMEOUT_SEC_MIN, TIMEOUT_SEC_MAX;
+var TIMEOUT_SEC_MIN, TIMEOUT_SEC_MAX, SESSION_ID_RE;
 var init_cron = __esm({
   "../server/dist/routes/cron.js"() {
     "use strict";
@@ -24811,6 +25236,7 @@ var init_cron = __esm({
     init_broadcast();
     TIMEOUT_SEC_MIN = 60;
     TIMEOUT_SEC_MAX = 21600;
+    SESSION_ID_RE = /^[A-Za-z0-9_:-]{1,200}$/;
   }
 });
 
@@ -25544,7 +25970,7 @@ function startTelegramChannel(deps) {
           if (!route)
             return;
           if (!isMediaPathAllowed(filePath, account.workspacePath)) {
-            console.log(`[Telegram] sendMedia blocked: ${filePath} not under workspace`);
+            console.warn(`[Telegram] sendMedia blocked: ${filePath} not under workspace`);
             return;
           }
           const kind = inferMediaKind(filePath);
@@ -26841,7 +27267,7 @@ function startWechatChannel(deps) {
           if (!route)
             return;
           if (!isMediaPathAllowed(filePath, account.workspacePath)) {
-            console.log(`[WeChat] sendMedia blocked: ${filePath} not under workspace`);
+            console.warn(`[WeChat] sendMedia blocked: ${filePath} not under workspace`);
             return;
           }
           await sendMediaFile({
@@ -28347,7 +28773,7 @@ function startSlackChannel(deps) {
               return;
             const resolved = path65.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[Slack] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[Slack] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -29493,7 +29919,7 @@ function startFeishuChannel(deps) {
               return;
             const resolved = path66.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[Feishu] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[Feishu] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -30356,7 +30782,7 @@ function startWecomChannel(deps) {
               return;
             const resolved = path67.resolve(filePath);
             if (!isMediaPathAllowed(resolved, account.workspacePath)) {
-              console.log(`[WeCom] sendMedia blocked: ${filePath} not under workspace`);
+              console.warn(`[WeCom] sendMedia blocked: ${filePath} not under workspace`);
               return;
             }
             try {
@@ -31166,7 +31592,7 @@ var init_dist2 = __esm({
     init_git_ssh();
     __dirname3 = path68.dirname(fileURLToPath3(import.meta.url));
     PORT = config.server.port;
-    HALO_VERSION = "1.3.4-c3090bf";
+    HALO_VERSION = "1.4.0";
     PROJECT_ROOT = findProjectRoot();
     HALO_HOME4 = path68.join(homedir24(), ".halo");
     GIT_SHA = readGitSha();
@@ -31213,7 +31639,7 @@ var init_dist2 = __esm({
       const { hiddenDirs, hiddenFiles, writableDirs } = reloadSandboxConfig();
       setSandboxHiddenPaths(hiddenDirs, hiddenFiles, writableDirs);
     });
-    console.log(`[Server] bwrap sandbox: ${isBwrapCached() ? "available" : "NOT available (app-level fallback only)"}`);
+    console.log(`[Server] OS sandbox: ${getSandboxBackend() ?? "NOT available (non-full sessions: no shell_exec, file tools path-checked in-process)"}`);
     ensureSshAgent();
     console.log(`[Server] Halo home: ${HALO_HOME4}`);
     console.log("[Server] Services initialized (ModelRuntime)");
@@ -31242,7 +31668,10 @@ var init_dist2 = __esm({
         uptime: process.uptime(),
         engine: "agent",
         version: HALO_VERSION,
-        gitSha: GIT_SHA
+        gitSha: GIT_SHA,
+        // OS sandbox backing non-full access levels; null → admin locks the
+        // access-level selector to Full.
+        sandbox: getSandboxBackend()
       });
     });
     fileRoutes = createFileRoutes();
@@ -31273,6 +31702,7 @@ var init_dist2 = __esm({
     }
     registry = new SessionManagerRegistry({ reconcileOrphansOnBoot: true });
     setRelayRegistry(registry);
+    setCronSessionRegistry(registry);
     for (const ws of listRunningWorkspaces()) {
       if (!fs62.existsSync(path68.join(ws, ".halo")))
         continue;
@@ -32101,7 +32531,7 @@ import path69 from "node:path";
 import fs63 from "node:fs";
 import { homedir as homedir25 } from "node:os";
 import { parseArgs as parseArgs2 } from "node:util";
-var VERSION = "1.3.4-c3090bf";
+var VERSION = "1.4.0";
 var HELP_TOP = `Usage: halo <command> [options]
 
 Commands: