@yagni-app/code-staging 1.1.0-staging.1325.1 → 1.1.0-staging.1327.1

package/dist/extension/sandbox/bash.d.ts

@@ -69,6 +69,29 @@ export declare function preWrappedCommand(manager: YagniSandboxManager, command:
  * offending path when found (pi-sandbox's regex, credited MIT).
  */
 export declare function extractBlockedWritePath(output: string): string | null;
+/** The three network-posture denial classes this classifier knows (closed
+ * set — rides the sink line as a low-cardinality field). */
+export type NetworkDenialClass = "ipc-listen" | "tls-trustd" | "loopback";
+/**
+ * Classify a sandbox network-posture denial from command output. Pure;
+ * advisory-only (never widens anything — the fix is a knob the USER flips,
+ * never an automatic grant). Matches the signatures observed live and in
+ * the session review:
+ *   - ipc-listen:   `listen EPERM` (node:events EPERM with syscall listen —
+ *                   a named unix-socket or TCP bind the profile denies;
+ *                   tsx/vitest test-runner IPC is the canonical case)
+ *   - tls-trustd:   `x509` + `OSStatus -26276` (Go TLS verification denied
+ *                   the trustd.agent mach lookup — gh/gcloud/terraform)
+ *   - loopback:     EPERM/"not permitted" on a connect to 127.0.0.1/
+ *                   localhost/::1 (loopback bypasses the proxy via
+ *                   no_proxy, so the allowlist can never admit it)
+ * Returns null when the output carries no network-posture signature — a
+ * plain file-write EPERM must NOT get a network hint.
+ */
+export declare function networkDenialHint(output: string): {
+    cls: NetworkDenialClass;
+    hint: string;
+} | null;
 /**
  * Wrap decision for user_bash (! commands): same rules as the tool, minus
  * the dangerouslyDisableSandbox parameter (users running ! commands are
@@ -78,9 +101,20 @@ export declare function shouldUseSandboxForUserCommand(command: string, manager:
 /**
  * Post-execution violation annotation: annotate a command's combined output
  * with sandbox violation details when the sandbox is active. Returns the
- * annotated output (or the original when nothing to annotate).
+ * annotated output (or the original when nothing to annotate) plus the
+ * network-posture classification (null when the output carried no network
+ * signature) so callers can log the sink event without a second regex pass.
+ * Composes the hint (networkDenialHint) after the violation detail —
+ * advisory only, never a grant. Uninitialized manager ⇒ passthrough, no
+ * hint (no annotation context, and the sink is not wired yet).
  */
-export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string): string;
+export declare function annotateCommandOutput(manager: YagniSandboxManager, command: string, output: string): {
+    text: string;
+    net: {
+        cls: NetworkDenialClass;
+        hint: string;
+    } | null;
+};
 /** cwd must exist before spawn (guard borrowed from pi's local ops). */
 export declare function assertSpawnableCwd(cwd: string): void;
 /**

package/dist/extension/sandbox/bash.js

@@ -131,6 +131,97 @@ export function extractBlockedWritePath(output) {
     const match = output.match(/(?:\/bin\/bash|bash|sh): (?:line \d+: )?(\/[^\s:]+): Operation not permitted/);
     return match ? match[1] : null;
 }
+/**
+ * Classify a sandbox network-posture denial from command output. Pure;
+ * advisory-only (never widens anything — the fix is a knob the USER flips,
+ * never an automatic grant). Matches the signatures observed live and in
+ * the session review:
+ *   - ipc-listen:   `listen EPERM` (node:events EPERM with syscall listen —
+ *                   a named unix-socket or TCP bind the profile denies;
+ *                   tsx/vitest test-runner IPC is the canonical case)
+ *   - tls-trustd:   `x509` + `OSStatus -26276` (Go TLS verification denied
+ *                   the trustd.agent mach lookup — gh/gcloud/terraform)
+ *   - loopback:     EPERM/"not permitted" on a connect to 127.0.0.1/
+ *                   localhost/::1 (loopback bypasses the proxy via
+ *                   no_proxy, so the allowlist can never admit it)
+ * Returns null when the output carries no network-posture signature — a
+ * plain file-write EPERM must NOT get a network hint.
+ */
+export function networkDenialHint(output) {
+    // ipc-listen: EPERM on a socket/TCP bind — node prints "listen EPERM: …",
+    // other tools print "EPERM … listen". Both orders are the same OS
+    // denial, but the second marker must be a socket/TCP-bind signal, not the
+    // bare word "listen" — a file-write EPERM whose text merely contains
+    // "listen" (e.g. `bash: ./listen.sh: Operation not permitted`) must stay a
+    // filesystem denial (the pinned invariant). Qualification is strictly
+    // SAME-LINE: socket markers, host:port addresses, and the inline
+    // syscall:'listen' token must all sit on the denial line itself (a stray
+    // IP:port or detail line elsewhere in the output is not a bind denial;
+    // node's two-line shape qualifies because its EPERM line carries the
+    // .pipe/.sock path or host:port address on its own line).
+    const sysListen = /syscall: ['"]listen['"]/i;
+    // The listen+EPERM denial shape. Two spellings are deliberately NOT a
+    // denial: the `syscall: 'listen'` value (stripped before the test — it
+    // is a detail-line token, not a denial verb, and a stray detail line
+    // anywhere in the output must not self-qualify) and filename-like
+    // tokens (listen.sh, listen:) — the bare word "listen" in a path is
+    // not a bind attempt (the listen.sh false-positive class). A line
+    // carrying its own syscall token still counts when it is otherwise a
+    // denial shape (an inline-token denial line, not a stray).
+    const denialShape = (line) => {
+        const stripped = line
+            .replace(/syscall: ['"]listen['"]/gi, "")
+            .replace(/\blisten[.:_-]\w*/gi, "");
+        return /\blisten\b/.test(stripped) && /\bEPERM\b|Operation not permitted/i.test(stripped);
+    };
+    const perLineMarker = /(\.sock\b|\.pipe\b|unix[- ]socket|\bipc\b|socket-domain|AF_UNIX|\bsocket\b|\bbind\b|\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}:\d+\b|\blocalhost:\d+\b)/i;
+    // A line CARRYING the syscall token but no other bind evidence is a
+    // node error-object DETAIL line (`  code: 'EPERM', … syscall: 'listen'`)
+    // — a continuation, never a denial line in its own right. Only an
+    // otherwise-denial line with its own INLINE syscall token (the one-line
+    // spelling) qualifies; a detail line riding on a neighbor never does.
+    // Socket markers and host:port addresses keep the same-line discipline.
+    if (/\blisten\b/.test(output)) {
+        const lines = output.split("\n");
+        // A real bind denial: a single line that is BOTH a denial shape and
+        // carries its own bind evidence (a socket/address marker, or the
+        // inline syscall token). No cross-line qualification: every observed
+        // node denial line carries its own evidence (the .pipe/.sock path or
+        // the host:port address), and letting a detail line ride on its
+        // neighbor is exactly how stray `syscall: 'listen'` lines from
+        // unrelated output false-positived. The detail line never qualifies
+        // in its own right.
+        const denialLine = lines.some((line) => denialShape(line) && (perLineMarker.test(line) || sysListen.test(line)));
+        if (denialLine) {
+            return {
+                cls: "ipc-listen",
+                hint: "This looks like a sandbox network-posture denial (a socket bind the sandbox profile denies — test-runner IPC is the usual case). " +
+                    "The user can fix it in the /sandbox panel (Network tab: the Engineering preset or the unix-sockets toggle); retrying with dangerouslyDisableSandbox is NOT needed once the knob is on.",
+            };
+        }
+    }
+    if (/x509[^\n]*OSStatus -26276|OSStatus -26276/.test(output)) {
+        return {
+            cls: "tls-trustd",
+            hint: "This looks like a sandbox TLS-verification denial (the trustd.agent mach lookup is denied — Go CLIs like gh verify certs through it even on allowlisted domains). " +
+                "The user can fix it in the /sandbox panel (Network tab: the Engineering preset or the trustd toggle); retrying with dangerouslyDisableSandbox is NOT needed once the knob is on.",
+        };
+    }
+    // Loopback connect denials: EPERM/not-permitted text with a loopback
+    // address nearby. Node prints `Error: listen EPERM ... (code: 'EPERM',
+    // syscall: 'connect', address: '127.0.0.1')`; curl prints the socket
+    // error line; generic CLIs print `connect() to 127.0.0.1 failed`.
+    if (/(EPERM|Operation not permitted|not permitted)/i.test(output) &&
+        /(127\.0\.0\.1|localhost|\[::1\]|"::1")/.test(output) &&
+        /(connect|curl|psql|wget|fetch|Failed to connect|Couldn't connect)/i.test(output)) {
+        return {
+            cls: "loopback",
+            hint: "This looks like a sandbox loopback denial (loopback bypasses the network allowlist, so localhost services are blocked by default). " +
+                "The user can fix it in the /sandbox panel (Network tab: the Engineering preset or the local-binding toggle); retrying with dangerouslyDisableSandbox is NOT needed once the knob is on.",
+        };
+    }
+    return null;
+}
 /**
  * Wrap decision for user_bash (! commands): same rules as the tool, minus
  * the dangerouslyDisableSandbox parameter (users running ! commands are
@@ -146,14 +237,25 @@ export function shouldUseSandboxForUserCommand(command, manager, settings) {
 /**
  * Post-execution violation annotation: annotate a command's combined output
  * with sandbox violation details when the sandbox is active. Returns the
- * annotated output (or the original when nothing to annotate).
+ * annotated output (or the original when nothing to annotate) plus the
+ * network-posture classification (null when the output carried no network
+ * signature) so callers can log the sink event without a second regex pass.
+ * Composes the hint (networkDenialHint) after the violation detail —
+ * advisory only, never a grant. Uninitialized manager ⇒ passthrough, no
+ * hint (no annotation context, and the sink is not wired yet).
  */
 export function annotateCommandOutput(manager, command, output) {
     if (!manager.initialized)
-        return output;
-    if (!output.includes("Operation not permitted"))
-        return output;
-    return manager.annotateStderrWithSandboxFailures(command, output);
+        return { text: output, net: null };
+    const net = networkDenialHint(output);
+    if (!output.includes("Operation not permitted") && !net)
+        return { text: output, net: null };
+    const annotated = output.includes("Operation not permitted")
+        ? manager.annotateStderrWithSandboxFailures(command, output)
+        : output;
+    if (!net)
+        return { text: annotated, net: null };
+    return { text: `${annotated}\n\n[sandbox] ${net.hint}`, net };
 }
 /** cwd must exist before spawn (guard borrowed from pi's local ops). */
 export function assertSpawnableCwd(cwd) {

package/dist/extension/sandbox/config.d.ts

@@ -76,6 +76,12 @@ export declare function loadSandboxSettings(opts?: {
     env?: NodeJS.ProcessEnv;
     userHome?: string;
     stateHomeOverride?: string | null;
+    /** When false, the project tier's network-widening knobs are dropped
+     * before the merge (a hostile repo's committed config cannot grant
+     * all-sockets / loopback / trustd). Defaults to true (trusted) — the
+     * callers that read the trust snapshot pass it explicitly; read-only
+     * surfaces (panel display, tests) can leave it unset. */
+    trusted?: boolean;
 }): LoadedSandboxConfig;
 export interface SandboxRuntimePaths {
     cwd: string;
@@ -84,6 +90,9 @@ export interface SandboxRuntimePaths {
     /** Project root; null outside a repo. */
     projectRoot: string | null;
     homeDir?: string;
+    /** Session env (drives the srt-forced-child tmpdir half of $TMPDIR
+     * expansion); defaults to process.env when absent. */
+    env?: NodeJS.ProcessEnv;
 }
 export interface SandboxRuntimeMerge {
     network: SandboxNetworkSettings & {

package/dist/extension/sandbox/config.js

@@ -23,6 +23,42 @@ import { existsSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { codeStateHome } from "../stateHome.js";
+/** Network-widening keys that must never come from a non-trusted repo's
+ * committed config (the project tier). All four open real surface —
+ * unix-socket path entries admit local services, allowAllUnixSockets admits
+ * docker.sock (host access), allowLocalBinding opens every loopback service,
+ * enableWeakerNetworkIsolation opens the trustd exfiltration vector. The
+ * LOCAL tier is deliberately NOT gated: a local write already needs local
+ * write access, and Claude Code does not trust-gate settings.local.json
+ * either (documented in sandboxing.md). */
+const NETWORK_WIDENING_KEYS = [
+    "allowUnixSockets",
+    "allowAllUnixSockets",
+    "allowLocalBinding",
+];
+/** Drop a tier's network-widening knobs (never call for the local tier). */
+function stripNetworkWidening(settings) {
+    if (!settings)
+        return settings;
+    const network = settings.network ? { ...settings.network } : undefined;
+    let touched = false;
+    if (network) {
+        for (const k of NETWORK_WIDENING_KEYS) {
+            if (network[k] !== undefined) {
+                delete network[k];
+                touched = true;
+            }
+        }
+    }
+    const top = { ...settings };
+    if (settings.enableWeakerNetworkIsolation !== undefined) {
+        delete top.enableWeakerNetworkIsolation;
+        touched = true;
+    }
+    if (touched && network)
+        top.network = network;
+    return touched ? top : settings;
+}
 const KNOWN_TOP_LEVEL_KEYS = new Set([
     "enabled",
     "autoAllowBashIfSandboxed",
@@ -223,8 +259,17 @@ export function loadSandboxSettings(opts = {}) {
     const projectPath = join(cwd, ".yagni-code", "config.json");
     const localPath = join(cwd, ".yagni-code", "config.local.json");
     const userSettings = readSandboxSettingsFromFile(userPath, warnings, unknownKeys);
-    const projectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
+    const rawProjectSettings = readSandboxSettingsFromFile(projectPath, warnings, unknownKeys);
     const localSettings = readSandboxSettingsFromFile(localPath, warnings, unknownKeys);
+    // Trust gate: a non-trusted repo's committed project config can set the
+    // network-widening knobs, which would silently open docker.sock /
+    // loopback / the trustd vector. Same posture as the permission-rule
+    // filtering: the local tier is personal (never gated), the project tier
+    // is only honored when the repo is trusted.
+    const projectSettings = opts.trusted === false ? stripNetworkWidening(rawProjectSettings) : rawProjectSettings;
+    if (opts.trusted === false && projectSettings !== rawProjectSettings) {
+        warnings.push("sandbox: network-widening keys ignored from project config (repo not trusted)");
+    }
     const settings = {
         enabled: localSettings?.enabled ?? projectSettings?.enabled ?? userSettings?.enabled ?? false,
         autoAllowBashIfSandboxed: localSettings?.autoAllowBashIfSandboxed ??
@@ -279,6 +324,31 @@ function resolveSandboxFsPath(pattern, base) {
         return pattern;
     return expandHome(pattern, homeDir);
 }
+/** The temp dir srt FORCES onto every sandboxed child (sandbox-utils.js
+ * generateProxyEnvVars): CLAUDE_CODE_TMPDIR || CLAUDE_TMPDIR ||
+ * "/tmp/claude". The child's TMPDIR is NOT the extension host's tmpdir —
+ * tsx/node/test-runner children bind their IPC sockets HERE, so the
+ * socket allow must cover it (and the host dir, for tooling that reads
+ * the ambient TMPDIR). */
+function srtForcedChildTmpdir(env) {
+    return env.CLAUDE_CODE_TMPDIR || env.CLAUDE_TMPDIR || "/tmp/claude";
+}
+/** allowUnixSockets entry resolution: the literal "$TMPDIR" marker expands
+ * to the TWO temp dirs a sandboxed session can have — the extension
+ * host's os.tmpdir() (env-honoring) AND the dir srt forces onto children
+ * (see srtForcedChildTmpdir). "$TMPDIR/..." prefixes expand against the
+ * HOST dir only (subpaths of the forced dir are an odd ask; keep them
+ * literal-precise). Anything else passes through verbatim (srt takes
+ * literal absolute paths). srt realpaths each entry into the SBPL subpath
+ * rule, so a /tmp symlink spelling composes at the OS level. */
+function expandTmpDirEntries(entry, env) {
+    if (entry === "$TMPDIR") {
+        return [...new Set([tmpdir(), srtForcedChildTmpdir(env)])];
+    }
+    if (entry.startsWith("$TMPDIR/"))
+        return [join(tmpdir(), entry.slice("$TMPDIR/".length))];
+    return [entry];
+}
 let homeDirDefault = () => homeDirImpl();
 import { homedir as homeDirImpl } from "node:os";
 function homeDirDefaultFn() { return homeDirImpl(); }
@@ -360,6 +430,19 @@ export function mergeRulesIntoSandbox(settings, rules, base, worktreeGit) {
         denyRead.add(resolveSandboxFsPath(p, base));
     for (const p of settings.filesystem?.allowRead ?? [])
         allowRead.add(resolveSandboxFsPath(p, base));
+    // allowUnixSockets: the portable "$TMPDIR" entry (what the Network tab's
+    // Engineering preset persists) expands to BOTH temp dirs a sandboxed session can have (the host's os.tmpdir() AND the dir srt forces onto children — they differ; see expandTmpDirEntries) —
+    // srt takes literal paths and emits one SBPL subpath rule per entry, so
+    // the expansion admits every random-named IPC socket a test runner binds
+    // there. Literal paths and ~/. entries pass through untouched (union
+    // semantics: a project/user entry plus the local "$TMPDIR" entry yield
+    // two paths). macOS-only surface (srt ignores the list on Linux, where
+    // seccomp cannot path-filter — the Linux preset uses the broader
+    // allowAllUnixSockets instead).
+    const expandEnv = base.env ?? process.env;
+    const allowUnixSockets = [
+        ...new Set((settings.network?.allowUnixSockets ?? []).flatMap((e) => expandTmpDirEntries(e, expandEnv))),
+    ];
     // Linked-worktree git access: allow writes to the shared common git dir
     // only (routine worktree git — index.lock, refs, objects — never writes
     // outside it), and pin hooks + config read-only within the newly allowed
@@ -392,6 +475,7 @@ export function mergeRulesIntoSandbox(settings, rules, base, worktreeGit) {
             ...settings.network,
             allowedDomains: [...allowedDomains],
             deniedDomains: [...deniedDomains],
+            allowUnixSockets,
         },
         filesystem: {
             allowRead: [...allowRead],

package/dist/extension/sandbox/manager.d.ts

@@ -32,6 +32,9 @@ export interface SandboxSessionOptions {
     rgPath?: string;
     askHandler?: NetworkAskHandler | null;
     events?: SandboxManagerEvents;
+    /** Trust snapshot for the network-widening config gate (project tier is
+     * dropped when false). session.ts sets it per trust-probe capture. */
+    trusted?: boolean;
 }
 export interface SandboxSessionState {
     /** srt initialized and commands will be wrapped. */
@@ -65,6 +68,10 @@ export declare class YagniSandboxManager {
     get settings(): SandboxSettings | null;
     get dependencies(): SandboxDependencyStatus | null;
     setAskHandler(handler: NetworkAskHandler | null): void;
+    /** Trust snapshot setter (session.ts's ctx probes run after
+     * construction). Read at merge time, so a trust flip applies to the next
+     * initialize/refresh without a reset. */
+    setTrusted(trusted: boolean): void;
     /** The failure-trail wrapper handed to srt — exported for tests so the
      * catch-and-log contract (fail closed + sink line) is observable without
      * driving a real wrapped network connection. */

package/dist/extension/sandbox/manager.js

@@ -58,6 +58,12 @@ export class YagniSandboxManager {
     setAskHandler(handler) {
         this.askHandler = handler;
     }
+    /** Trust snapshot setter (session.ts's ctx probes run after
+     * construction). Read at merge time, so a trust flip applies to the next
+     * initialize/refresh without a reset. */
+    setTrusted(trusted) {
+        this.opts.trusted = trusted;
+    }
     /** The failure-trail wrapper handed to srt — exported for tests so the
      * catch-and-log contract (fail closed + sink line) is observable without
      * driving a real wrapped network connection. */
@@ -106,6 +112,7 @@ export class YagniSandboxManager {
             env: this.opts.env,
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
+            trusted: this.opts.trusted,
         });
         this.surfaceConfigDiagnostics(diagnostics);
         const worktreeGit = this.state.worktreeGit !== undefined
@@ -116,6 +123,7 @@ export class YagniSandboxManager {
             userStateHome: this.opts.stateHomeOverride ?? codeStateHome(null, this.opts.env, this.opts.userHome),
             projectRoot: this.opts.projectRoot ?? null,
             homeDir: this.opts.userHome,
+            env: this.opts.env ?? process.env,
         }, worktreeGit);
     }
     runtimeConfig(merge, settings) {
@@ -166,6 +174,7 @@ export class YagniSandboxManager {
             env: this.opts.env,
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
+            trusted: this.opts.trusted,
         });
         // Same warning surfacing as buildRuntimeMerge — initialize() skips
         // buildRuntimeMerge on the disabled path, so its own load reports too.
@@ -218,6 +227,7 @@ export class YagniSandboxManager {
             env: this.opts.env,
             userHome: this.opts.userHome,
             stateHomeOverride: this.opts.stateHomeOverride,
+            trusted: this.opts.trusted,
         }).settings));
     }
     /**

package/dist/extension/sandbox/panel.d.ts

@@ -22,9 +22,12 @@ import { Container, type SelectItem } from "@earendil-works/pi-tui";
 import { type SandboxRuntimeMerge, type SandboxRuntimePaths, type SandboxSettings } from "./config.js";
 import type { RenderTheme } from "../subagentRender.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
-export type SandboxPanelTab = "mode" | "overrides" | "config" | "dependencies";
+export type SandboxPanelTab = "mode" | "overrides" | "network" | "config" | "dependencies";
 export type SandboxModeChoice = "auto-allow" | "regular" | "disabled";
 export type SandboxOverrideChoice = "open" | "closed";
+/** A Network-tab selection: the one-click Engineering preset (platform-
+ * shaped composition) or an individual knob toggle. */
+export type SandboxNetworkChoice = "engineering-preset" | "engineering-preset-off" | "trustd" | "trustd-off" | "unix-sockets" | "unix-sockets-off" | "local-binding" | "local-binding-off";
 /** Everything the panel needs, resolved by the caller (session.ts). */
 export interface SandboxPanelState {
     settings: SandboxSettings;
@@ -44,12 +47,16 @@ export interface SandboxPanelActions {
     onModeSelect: (choice: SandboxModeChoice) => Promise<SandboxPanelOutcome>;
     /** Persist an override choice. Same contract. */
     onOverrideSelect: (choice: SandboxOverrideChoice) => Promise<SandboxPanelOutcome>;
+    /** Persist a network-posture choice (preset or single knob). Same
+     * contract; the knob state derives from the settings snapshot the panel
+     * was built with. */
+    onNetworkSelect: (choice: SandboxNetworkChoice) => Promise<SandboxPanelOutcome>;
 }
 /** What the panel hands back when it closes: the confirmation (or error)
  * the session surfaces via notify once custom() resolves. */
 export interface SandboxPanelOutcome {
     text: string;
-    level: "info" | "error";
+    level: "info" | "error" | "warning";
 }
 /** Current mode derived from resolved settings (Claude's currentMode). */
 export declare function deriveCurrentMode(settings: SandboxSettings, sessionToggledOff: boolean): SandboxModeChoice;
@@ -59,6 +66,28 @@ export declare function overrideOptions(current: SandboxOverrideChoice): SelectI
 /** Per-mode explanation (Claude's copy, adapted to our surfaces). */
 export declare function modeExplanation(mode: SandboxModeChoice): string;
 export declare function overrideExplanation(choice: SandboxOverrideChoice): string;
+/** The three knobs' resolved state, derived from settings (undefined =
+ * unset, which resolves OFF at the runtime). */
+export interface NetworkKnobState {
+    trustd: boolean;
+    /** macOS: the $TMPDIR entry is present in allowUnixSockets; Linux:
+     * allowAllUnixSockets (path-scoped lists are macOS-only — seccomp cannot
+     * path-filter). */
+    unixSockets: boolean;
+    localBinding: boolean;
+}
+export declare function deriveNetworkKnobs(settings: SandboxSettings, platform: NodeJS.Platform): NetworkKnobState;
+/** Does the platform-shape of the preset match the knobs already resolved
+ * on? Drives the preset row's "(applied)" label. Platform-shaped: on
+ * Linux the preset never sets trustd (macOS-only), so "applied" is
+ * sockets+loopback there; on darwin it is all three. */
+export declare function presetApplied(knobs: NetworkKnobState, platform: NodeJS.Platform): boolean;
+/** The literal settings block the preset persists per platform (the local
+ * tier; session.ts owns the write). Exported so session + tests share one
+ * composition — the panel never builds it ad hoc. */
+export declare function engineeringPresetBlock(platform: NodeJS.Platform): SandboxSettings;
+export declare function networkOptions(knobs: NetworkKnobState, platform: NodeJS.Platform): SelectItem[];
+export declare function networkExplanation(item: SelectItem, platform: NodeJS.Platform): string;
 /**
  * Config tab sections, conditional like Claude's SandboxConfigTab: empty
  * sections are omitted entirely (Excluded Commands — Claude's one always-on
@@ -70,7 +99,8 @@ export interface ConfigSection {
     detail: string[];
 }
 export declare function configSections(state: SandboxPanelState): ConfigSection[];
-/** Tabs offered, mirroring Claude: Dependencies appears only on errors. */
+/** Tabs offered, mirroring Claude plus our Network tab (the deliberate
+ * deviation): Dependencies appears only on errors. */
 export declare function panelTabs(dependencyErrors: string[]): SandboxPanelTab[];
 /**
  * The /sandbox panel. Structure: top border · tab strip · blank · tab
@@ -95,6 +125,7 @@ export declare class SandboxPanel extends Container {
     private buildBody;
     private buildTabContent;
     private buildModeTab;
+    private buildNetworkTab;
     private buildOverridesTab;
     private buildConfigTab;
     private buildDependenciesTab;

package/dist/extension/sandbox/panel.js

@@ -21,6 +21,7 @@
 import { Box, Container, HStack, Key, SelectList, Text, matchesKey, } from "@earendil-works/pi-tui";
 import { mergeRulesIntoSandbox } from "./config.js";
 import { resolveWorktreeGitAccess } from "./worktreeGit.js";
+import { logEvent } from "../errorSink.js";
 // ---------------------------------------------------------------------------
 // Pure derivation helpers (unit-tested; no TUI dependency)
 // ---------------------------------------------------------------------------
@@ -62,6 +63,106 @@ export function overrideExplanation(choice) {
         ? "When a command fails due to sandbox restrictions, the agent can retry with dangerouslyDisableSandbox to run outside the sandbox (falling back to default permissions)."
         : "All bash commands invoked by the model must run in the sandbox unless they are explicitly listed in excludedCommands.";
 }
+export function deriveNetworkKnobs(settings, platform) {
+    const sockets = platform === "darwin"
+        ? (settings.network?.allowUnixSockets ?? []).some((e) => e === "$TMPDIR" || e === "$TMPDIR/")
+        : settings.network?.allowAllUnixSockets === true;
+    return {
+        trustd: settings.enableWeakerNetworkIsolation === true,
+        unixSockets: sockets,
+        localBinding: settings.network?.allowLocalBinding === true,
+    };
+}
+/** Does the platform-shape of the preset match the knobs already resolved
+ * on? Drives the preset row's "(applied)" label. Platform-shaped: on
+ * Linux the preset never sets trustd (macOS-only), so "applied" is
+ * sockets+loopback there; on darwin it is all three. */
+export function presetApplied(knobs, platform) {
+    if (platform === "darwin")
+        return knobs.trustd && knobs.unixSockets && knobs.localBinding;
+    return knobs.unixSockets && knobs.localBinding;
+}
+/** The literal settings block the preset persists per platform (the local
+ * tier; session.ts owns the write). Exported so session + tests share one
+ * composition — the panel never builds it ad hoc. */
+export function engineeringPresetBlock(platform) {
+    if (platform === "darwin") {
+        return {
+            enableWeakerNetworkIsolation: true,
+            network: { allowUnixSockets: ["$TMPDIR"], allowLocalBinding: true },
+        };
+    }
+    return {
+        network: { allowAllUnixSockets: true, allowLocalBinding: true },
+    };
+}
+export function networkOptions(knobs, platform) {
+    const isMac = platform === "darwin";
+    const items = [
+        {
+            value: "engineering-preset",
+            label: `Engineering preset: tests + gh + localhost in one click${presetApplied(knobs, platform) ? " (applied)" : ""}`,
+            description: "Unix sockets in the temp dir (test-runner IPC), macOS TLS chain verification, and loopback connections — the routine engineering-work knobs",
+        },
+    ];
+    if (isMac) {
+        items.push({
+            value: "trustd",
+            label: `macOS TLS verification via trustd: ${knobs.trustd ? "on" : "off"}`,
+            description: "Go CLIs (gh, gcloud, terraform) verify TLS through com.apple.trustd.agent; allowing it opens a potential data exfiltration vector through the trustd service",
+        });
+        items.push({
+            value: "unix-sockets",
+            label: `Unix sockets in $TMPDIR: ${knobs.unixSockets ? "on" : "off"}`,
+            description: "Admits test-runner IPC binds (tsx, vitest, node workers) inside the sandbox temp dir only",
+        });
+    }
+    else {
+        items.push({
+            value: "unix-sockets",
+            label: `All unix sockets: ${knobs.unixSockets ? "on" : "off"}`,
+            description: "seccomp cannot path-filter on Linux, so this is all-or-nothing — docker.sock included. Test-runner IPC needs it",
+        });
+    }
+    items.push({
+        value: "local-binding",
+        label: `Localhost connections + binding: ${knobs.localBinding ? "on" : "off"}`,
+        description: "Loopback bypasses the domain allowlist (localhost services and dev servers/DBs become reachable without prompts)",
+    });
+    // Remove-entries ride the same list as -off variants: SelectItem values
+    // are matched literally by the onSelect handler.
+    if (knobs.trustd || knobs.unixSockets || knobs.localBinding) {
+        items.push({
+            value: "engineering-preset-off",
+            label: "Remove the preset knobs (set off in this project's local settings)",
+            description: "Writes explicit off values to .yagni-code/config.local.json; project/user entries stay as they are",
+        });
+    }
+    return items;
+}
+export function networkExplanation(item, platform) {
+    switch (item.value) {
+        case "engineering-preset":
+            return platform === "darwin"
+                ? "Applies: unix sockets in $TMPDIR + trustd TLS verification + localhost connections. Held work (pnpm/tsx test runs, gh, psql to localhost) runs sandboxed instead of escaping. The trustd knob opens a potential data exfiltration vector through the trustd service — that tradeoff is yours to accept."
+                : "Applies: all unix sockets (no path filtering on Linux — docker.sock included) + localhost connections. Held work (test runs, local DB clients) runs sandboxed instead of escaping.";
+        case "trustd":
+        case "trustd-off":
+            return "Needed for Go TLS verification (gh, gcloud, terraform). Enabling opens a potential data exfiltration vector through the trustd service — off by default.";
+        case "unix-sockets":
+        case "unix-sockets-off":
+            return platform === "darwin"
+                ? "Allows binding unix sockets under $TMPDIR only — every tsx/vitest/node test-runner IPC socket lives there. Writes to $TMPDIR are already sandbox-allowed, so this stays low-risk."
+                : "All-or-nothing on Linux: seccomp cannot filter socket paths, so allowing test-runner IPC also allows docker.sock. Off by default; excludedCommands can keep specific commands out of the sandbox instead.";
+        case "local-binding":
+        case "local-binding-off":
+            return "psql/redis to localhost, dev servers on :4567, and any 127.0.0.1 client. Loopback bypasses the per-domain allowlist — this is all-or-nothing for localhost.";
+        case "engineering-preset-off":
+            return "Writes explicit OFF values to this project's local settings — local wins over project/user on scalars, so a knob set higher up stops applying here. The $TMPDIR socket entry is removed from the local list. Entries committed to project or user config are NOT changed — edit those files directly to turn a knob back on there.";
+        default:
+            return "";
+    }
+}
 export function configSections(state) {
     const { settings, merge } = state;
     const sections = [];
@@ -93,14 +194,24 @@ export function configSections(state) {
     const unixSockets = settings.network?.allowUnixSockets ?? [];
     if (unixSockets.length > 0)
         sections.push({ title: "Allowed Unix Sockets", detail: [unixSockets.join(", ")] });
+    if (merge.network.allowLocalBinding) {
+        sections.push({ title: "Local Binding", detail: ["loopback + private ranges allowed (localhost clients, dev servers, DB tunnels)"] });
+    }
+    if (settings.network?.allowAllUnixSockets) {
+        sections.push({ title: "All Unix Sockets", detail: ["allowed (Linux posture — includes docker.sock)"] });
+    }
+    if (settings.enableWeakerNetworkIsolation) {
+        sections.push({ title: "Weaker Network Isolation", detail: ["trustd.agent allowed (Go TLS verification; opens a trustd exfiltration vector)"] });
+    }
     if (state.sessionGrants.length > 0) {
         sections.push({ title: "Session Grants (memory-only)", detail: [state.sessionGrants.join(", ")] });
     }
     return sections;
 }
-/** Tabs offered, mirroring Claude: Dependencies appears only on errors. */
+/** Tabs offered, mirroring Claude plus our Network tab (the deliberate
+ * deviation): Dependencies appears only on errors. */
 export function panelTabs(dependencyErrors) {
-    const tabs = ["mode", "overrides", "config"];
+    const tabs = ["mode", "overrides", "network", "config"];
     if (dependencyErrors.length > 0)
         tabs.push("dependencies");
     return tabs;
@@ -111,6 +222,7 @@ export function panelTabs(dependencyErrors) {
 const TAB_LABELS = {
     mode: "Mode",
     overrides: "Overrides",
+    network: "Network",
     config: "Config",
     dependencies: "Dependencies",
 };
@@ -201,6 +313,8 @@ export class SandboxPanel extends Container {
                 return this.buildModeTab();
             case "overrides":
                 return this.buildOverridesTab();
+            case "network":
+                return this.buildNetworkTab();
             case "config":
                 return this.buildConfigTab();
             case "dependencies":
@@ -240,6 +354,51 @@ export class SandboxPanel extends Container {
         wrap.addChild(explanation);
         return wrap;
     }
+    buildNetworkTab() {
+        const t = this.theme;
+        if (!this.state.settings.enabled) {
+            this.activeList = null;
+            return new Text(t.fg("muted", "Sandbox is not enabled. Enable sandbox to configure network posture."), 0, 0);
+        }
+        const knobs = deriveNetworkKnobs(this.state.settings, process.platform);
+        const options = networkOptions(knobs, process.platform);
+        const list = new SelectList(options, 10, selectListTheme(t));
+        const explanation = new Text(t.fg("muted", networkExplanation(options[0], process.platform)), 0, 1);
+        list.onSelectionChange = (item) => {
+            explanation.setText(t.fg("muted", networkExplanation(item, process.platform)));
+            this.invalidate();
+        };
+        list.onSelect = (item) => {
+            void this.actions
+                .onNetworkSelect(item.value)
+                .then((outcome) => this.done(outcome))
+                // A rejection AFTER a successful persist (e.g. load() or
+                // refreshConfig blew up) must not close the panel silently — the
+                // write may have landed while the live refresh did not, so the
+                // user gets the honest message AND the trail gets the reason
+                // (error class only; the thrown message is never scrubbed into
+                // the sink — same posture as sandbox_persist_failed).
+                .catch((err) => {
+                logEvent({
+                    source: "sandbox",
+                    level: "warn",
+                    event: "sandbox_refresh_failed",
+                    fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+                });
+                this.done({
+                    text: "Network setting saved, but applying it to the live session failed — restart the session (or /new) to make it take effect.",
+                    level: "warning",
+                });
+            });
+        };
+        list.onCancel = () => this.done();
+        this.activeList = list;
+        const wrap = new Container();
+        wrap.addChild(new Text(t.bold("Network posture for engineering work:"), 0, 0));
+        wrap.addChild(list);
+        wrap.addChild(explanation);
+        return wrap;
+    }
     buildOverridesTab() {
         const t = this.theme;
         if (!this.state.settings.enabled) {

package/dist/extension/sandbox/session.d.ts

@@ -14,6 +14,7 @@
 import { type ExtensionAPI, type ExtensionContext, type ToolDefinition } from "@earendil-works/pi-coding-agent";
 import { type SandboxSettings } from "./config.js";
 import { YagniSandboxManager } from "./manager.js";
+import { type SandboxNetworkChoice } from "./panel.js";
 import type { PermissionRule } from "../permissionRules/loadConfig.js";
 /**
  * Build the sandbox bash composition: given ANY stock bash definition (pi's
@@ -63,7 +64,7 @@ export interface RegisterSandboxOptions {
         stateHomeOverride?: string | null;
         projectRoot?: string | null;
         rgPath?: string;
-    }) => Pick<YagniSandboxManager, "initialized" | "initialize" | "reset" | "refreshConfig" | "setAskHandler" | "wrapWithSandbox" | "cleanupAfterCommand" | "annotateStderrWithSandboxFailures"> & YagniSandboxManager;
+    }) => Pick<YagniSandboxManager, "initialized" | "initialize" | "reset" | "refreshConfig" | "setAskHandler" | "setTrusted" | "wrapWithSandbox" | "cleanupAfterCommand" | "annotateStderrWithSandboxFailures"> & YagniSandboxManager;
     /** Whether interactive prompts are possible (TUI/RPC). */
     hasUI: (ctx: ExtensionContext) => boolean;
     /**
@@ -82,4 +83,16 @@ export interface RegisterSandboxOptions {
  * sandbox (no-op registration, stock bash stays).
  */
 export declare function registerSandbox(pi: ExtensionAPI, opts: RegisterSandboxOptions): SandboxSessionHandle | null;
+/** Persist a Network-tab choice (the Engineering preset or a single knob
+ * toggle) to the PROJECT-LOCAL config — same destination + honesty contract
+ * as the other panel writes. The preset composes the platform-shaped block
+ * from panel.ts (one source of truth for the composition) and NORMALIZES
+ * the other platform's knobs off (a stale broader door — or a stale trustd
+ * value on Linux — never survives a preset apply silently); knob toggles
+ * write explicit off values so local precedence overrides any project/user
+ * on-state. The $TMPDIR socket entry is REMOVED from the local array (not
+ * falsed — arrays have no false), so un-applying the preset leaves the
+ * local tier clean; project/user entries keep applying by union. Exported
+ * for tests (the per-platform branches are pinned directly). */
+export declare function persistNetworkChoice(choice: SandboxNetworkChoice, cwd: string, platform?: NodeJS.Platform): void;
 //# sourceMappingURL=session.d.ts.map

package/dist/extension/sandbox/session.js

@@ -23,9 +23,9 @@ import { isDebug } from "../diagnostics.js";
 import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
 import { loadSandboxSettings } from "./config.js";
 import { resolveWorktreeGitAccess } from "./worktreeGit.js";
-import { annotateCommandOutput, makeSandboxSpawnHook, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
+import { annotateCommandOutput, makeSandboxSpawnHook, networkDenialHint, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
 import { YagniSandboxManager } from "./manager.js";
-import { SandboxPanel, buildPanelState } from "./panel.js";
+import { SandboxPanel, buildPanelState, engineeringPresetBlock } from "./panel.js";
 import { effectiveRules } from "../permissionRules/loadConfig.js";
 /**
  * Build the sandbox bash composition: given ANY stock bash definition (pi's
@@ -68,7 +68,20 @@ export function makeBashComposition(manager, settings, cwd) {
         restrictions.push(allowed.length > 0
             ? `Network: only these domains (wildcards ok): ${allowed.join(", ")}`
             : "Network: no domains pre-allowed — the first contact to each host prompts the user");
-        restrictions.push(`Filesystem writes: working directory, /tmp, and paths granted by Edit(...) allow rules`);
+        restrictions.push(`Filesystem writes: working directory, the session temp dir ($TMPDIR), and paths granted by Edit(...) allow rules — /tmp itself is NOT writable; only the per-user temp dir is`);
+        if (s.network?.allowLocalBinding) {
+            restrictions.push("Localhost: connections and binds to 127.0.0.1/localhost are allowed (local DBs, dev servers, tunnels) — loopback bypasses the domain allowlist by design");
+        }
+        const hasTmpSockets = (s.network?.allowUnixSockets ?? []).some((e) => e === "$TMPDIR" || e === "$TMPDIR/");
+        if (s.network?.allowAllUnixSockets) {
+            restrictions.push("Unix sockets: ALL allowed (Linux posture — includes docker.sock; test runners and IPC clients work)");
+        }
+        else if (hasTmpSockets) {
+            restrictions.push("Unix sockets in the temp dir ($TMPDIR): allowed — test runners (tsx, vitest, node --test with process isolation) and other IPC that binds there work sandboxed");
+        }
+        if (s.enableWeakerNetworkIsolation) {
+            restrictions.push("macOS TLS verification (trustd): allowed — Go CLIs (gh, gcloud, terraform) can verify certificates against allowlisted domains");
+        }
         // A linked-worktree session additionally allows the shared common git
         // dir (git operations work sandboxed there); the description must say
         // so or the model under-reports what it can do.
@@ -80,9 +93,14 @@ export function makeBashComposition(manager, settings, cwd) {
         const strictNote = s.allowUnsandboxedCommands === false
             ? "All commands MUST run sandboxed — dangerouslyDisableSandbox is disabled by policy."
             : "Default to running commands in the sandbox. Set dangerouslyDisableSandbox: true ONLY with evidence of a sandbox-caused failure (\"Operation not permitted\", denied path/host, unix-socket errors) — the retry still goes through the normal permission flow. The user can adjust restrictions with /sandbox.";
+        // Heredoc caveat (verified live): macOS bash 3.2 writes heredoc temp
+        // files relative to the CURRENT DIRECTORY, not TMPDIR — so heredocs
+        // fail once cwd drifts outside the writable roots. Stated once, after
+        // the restrictions, so the model doesn't reach for it blindly.
+        const heredocNote = "Caveat: heredocs (<<EOF) write temp files relative to the current directory on macOS bash 3.2 — from an unwritable cwd they fail; prefer printf or redirect from a file in the working directory.";
         const wrapped = {
             ...def,
-            description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}`,
+            description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}\n${heredocNote}`,
             parameters: schema,
             async execute(id, params, signal, onUpdate, ctx) {
                 const input = params;
@@ -103,9 +121,14 @@ export function makeBashComposition(manager, settings, cwd) {
                     result = await sandboxBash.execute(id, execParams, signal, onUpdate, ctx);
                 }
                 catch (err) {
-                    if (err instanceof Error && err.message.includes("Operation not permitted")) {
+                    if (err instanceof Error && (err.message.includes("Operation not permitted") || networkDenialHint(err.message))) {
+                        // The thrown-message gate matches the result-text gate: a
+                        // network-signature denial in EITHER surface gets the
+                        // annotation + hint (node throws lowercase "operation not
+                        // permitted", which the bare substring misses).
                         const annotated = annotateCommandOutput(manager, input.command, err.message);
-                        throw new Error(annotated);
+                        logNetworkDenialHint(annotated.net);
+                        throw new Error(annotated.text);
                     }
                     throw err;
                 }
@@ -114,9 +137,10 @@ export function makeBashComposition(manager, settings, cwd) {
                 }
                 if (result?.content) {
                     const text = result.content.map((c) => (c.type === "text" ? c.text : "")).join("\n");
-                    if (text.includes("Operation not permitted")) {
+                    if (text.includes("Operation not permitted") || networkDenialHint(text)) {
                         const annotated = annotateCommandOutput(manager, input.command, text);
-                        result = { ...result, content: [{ type: "text", text: annotated }] };
+                        logNetworkDenialHint(annotated.net);
+                        result = { ...result, content: [{ type: "text", text: annotated.text }] };
                     }
                 }
                 return result;
@@ -198,6 +222,7 @@ export function registerSandbox(pi, opts) {
                 trustedSnapshot = ctx.isProjectTrusted();
         }
         catch (err) {
+            void err;
             // Keep the prior snapshot (fail-open parity with the gate) but make
             // the throw VISIBLE: warn (not debug) — readSessionTrail filters debug
             // lines, so a debug event would never reach /feedback; a trust-probe
@@ -213,6 +238,13 @@ export function registerSandbox(pi, opts) {
     };
     /** Rules filtered to what the sandbox may enforce OS-wide (trust-aware). */
     const effectiveRulesForSandbox = () => effectiveRules(rules, trustedSnapshot);
+    // The network-widening config gate (project-tier knobs dropped when the
+    // repo is untrusted) reads the SAME snapshot — applied to the manager on
+    // every ctx capture (session_start AND tool_call) so a mid-session trust
+    // flip reaches the config gate alongside the rule gate without a reset.
+    const applyTrustToManager = () => {
+        manager.setTrusted(trustedSnapshot);
+    };
     const sessionDomainGrants = new Set();
     const askHandler = async (host) => {
         if (sessionDomainGrants.has(host))
@@ -335,8 +367,19 @@ export function registerSandbox(pi, opts) {
                 if (timeout !== undefined && timeout > 0) {
                     timeoutHandle = setTimeout(() => { timedOut = true; killGroup(); }, timeout * 1000);
                 }
-                child.stdout?.on("data", onData);
-                child.stderr?.on("data", onData);
+                // Tail buffer (bounded) so a network-posture denial can be
+                // annotated + hinted after the child exits — the tool-call path
+                // annotates via annotateCommandOutput; the !-command path owns its
+                // own composition here (the classifier + hint ride the last 8KB).
+                let tail = "";
+                const MAX_TAIL = 8 * 1024;
+                const onChunk = (d) => {
+                    const text = d.toString();
+                    tail = (tail + text).slice(-MAX_TAIL);
+                    onData(d);
+                };
+                child.stdout?.on("data", onChunk);
+                child.stderr?.on("data", onChunk);
                 signal?.addEventListener("abort", killGroup, { once: true });
                 try {
                     const exitCode = await waitForChildProcess(child);
@@ -344,6 +387,13 @@ export function registerSandbox(pi, opts) {
                         throw new Error("aborted");
                     if (timedOut)
                         throw new Error(`timeout:${timeout}`);
+                    // Post-run hint: same advisory as the tool path, appended after
+                    // the child's own output so the user sees the fix pointer inline.
+                    const net = networkDenialHint(tail);
+                    if (net) {
+                        logEvent({ source: "sandbox", level: "info", event: "network_denial_hint", fields: { class: net.cls } });
+                        onData(Buffer.from(`\n[sandbox] ${net.hint}`));
+                    }
                     return { exitCode };
                 }
                 finally {
@@ -362,11 +412,15 @@ export function registerSandbox(pi, opts) {
     pi.on("tool_call", async (_event, ctx) => {
         captureUi(ctx);
         captureTrust(ctx);
+        // Mid-session trust flips must reach the manager's CONFIG gate too, not
+        // just the rule gate — applyTrustToManager is cheap (a boolean set).
+        applyTrustToManager();
         return;
     });
     pi.on("session_start", async (_event, ctx) => {
         captureUi(ctx);
         captureTrust(ctx);
+        applyTrustToManager();
         currentSettings = load();
         // --no-sandbox skips init in EVERY mode — headless included. The notify
         // is UI-gated, the SKIP never is (a UI-only skip would silently keep the
@@ -418,6 +472,15 @@ export function registerSandbox(pi, opts) {
             lines.push(`deniedDomains: ${s.network.deniedDomains.join(", ")}`);
         if (s.network?.allowLocalBinding)
             lines.push("allowLocalBinding: yes (loopback + private ranges)");
+        const tmpSocket = (s.network?.allowUnixSockets ?? []).some((e) => e === "$TMPDIR" || e === "$TMPDIR/");
+        if (s.network?.allowAllUnixSockets)
+            lines.push("allowAllUnixSockets: yes (ALL unix sockets — includes docker.sock)");
+        else if (s.network?.allowUnixSockets?.length)
+            lines.push(`allowUnixSockets: ${s.network.allowUnixSockets.join(", ")}`);
+        if (tmpSocket)
+            lines.push("  (the $TMPDIR entry covers test-runner IPC sockets — the Engineering preset's sockets knob)");
+        if (s.enableWeakerNetworkIsolation)
+            lines.push("enableWeakerNetworkIsolation: yes (trustd allowed — Go TLS verification; opens a trustd exfiltration vector)");
         if (s.filesystem?.allowWrite?.length)
             lines.push(`allowWrite: ${s.filesystem.allowWrite.join(", ")}`);
         if (s.filesystem?.denyWrite?.length)
@@ -608,6 +671,50 @@ export function registerSandbox(pi, opts) {
                     level: "info",
                 };
             },
+            onNetworkSelect: async (choice) => {
+                // Knob changes apply LIVE (refreshConfig swaps the runtime config
+                // and srt reads the knobs at wrap time per command) — no restart.
+                // The bash DESCRIPTION stays stale until restart (load-time text);
+                // the denial hint is the mid-session discovery path. Stated in the
+                // outcome so the user knows the exact boundary.
+                try {
+                    persistNetworkChoice(choice, opts.cwd);
+                }
+                catch (err) {
+                    // Same diagnosability posture as sandbox_persist_failed: the
+                    // thrown message is mutateConfigJson's own path/reason text —
+                    // surfaced, never silently swallowed.
+                    logEvent({
+                        source: "sandbox",
+                        level: "warn",
+                        event: "sandbox_persist_failed",
+                        fields: {
+                            kind: "network",
+                            choice,
+                            error: err instanceof Error ? err.message : String(err),
+                        },
+                    });
+                    return {
+                        text: `Could not write the network setting to .yagni-code/config.local.json — edit it directly (see /sandbox docs for the keys) and restart.`,
+                        level: "error",
+                    };
+                }
+                currentSettings = load();
+                if (manager.initialized)
+                    manager.refreshConfig(effectiveRulesForSandbox());
+                const applied = choice === "engineering-preset";
+                const detail = choice === "engineering-preset"
+                    ? "tests, gh, and localhost clients now run sandboxed (live — no restart needed; the bash tool's description updates on the next session)"
+                    : choice === "engineering-preset-off"
+                        ? "explicit off values written to this project's local settings (local wins over project/user, so higher-tier knob values stop applying); files at other tiers are unchanged"
+                        : "saved to project-local settings and applied live";
+                return {
+                    text: applied
+                        ? `✓ Engineering preset applied — ${detail}`
+                        : `✓ Network setting — ${detail}`,
+                    level: "info",
+                };
+            },
         };
         let outcome;
         try {
@@ -674,6 +781,17 @@ export function registerSandbox(pi, opts) {
 function isPlainRecord(v) {
     return typeof v === "object" && v !== null && !Array.isArray(v);
 }
+/** Sink line when the network-posture classifier fires — the impact
+ * signal (paired with tool_execute_decision's useSandbox it makes the
+ * escape-rate before/after readable from the trail). Closed enum class,
+ * no command content. Takes the already-computed classification (the
+ * classifier runs ONCE per denial — at the annotation site) so the logged
+ * class can never disagree with the hint the user saw. */
+function logNetworkDenialHint(net) {
+    if (!net)
+        return;
+    logEvent({ source: "sandbox", level: "info", event: "network_denial_hint", fields: { class: net.cls } });
+}
 /** Sink line for a failed domain-grant persist — the thrown message is
  * mutateConfigJson's own path/reason text (diagnosable, no file content),
  * same posture as sandbox_persist_failed / rule_save_failed. */
@@ -751,6 +869,82 @@ function persistSandboxOverride(choice, cwd) {
         config.sandbox = sandbox;
     }, "sandbox");
 }
+/** Persist a Network-tab choice (the Engineering preset or a single knob
+ * toggle) to the PROJECT-LOCAL config — same destination + honesty contract
+ * as the other panel writes. The preset composes the platform-shaped block
+ * from panel.ts (one source of truth for the composition) and NORMALIZES
+ * the other platform's knobs off (a stale broader door — or a stale trustd
+ * value on Linux — never survives a preset apply silently); knob toggles
+ * write explicit off values so local precedence overrides any project/user
+ * on-state. The $TMPDIR socket entry is REMOVED from the local array (not
+ * falsed — arrays have no false), so un-applying the preset leaves the
+ * local tier clean; project/user entries keep applying by union. Exported
+ * for tests (the per-platform branches are pinned directly). */
+export function persistNetworkChoice(choice, cwd, platform = process.platform) {
+    mutateLocalConfig(cwd, (config) => {
+        const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
+        const network = isPlainRecord(sandbox.network) ? { ...sandbox.network } : {};
+        const sockets = isPlainRecord(network) ? (Array.isArray(network.allowUnixSockets) ? [...network.allowUnixSockets] : []) : [];
+        /** Copy-on-write: set/remove the $TMPDIR entry in the local socket
+         * array (arrays have no false — removal, not a value write). */
+        const setTmpdirSockets = (on) => {
+            const withoutTmp = sockets.filter((e) => e !== "$TMPDIR" && e !== "$TMPDIR/");
+            network.allowUnixSockets = on ? [...withoutTmp, "$TMPDIR"] : withoutTmp;
+        };
+        switch (choice) {
+            case "engineering-preset": {
+                const block = engineeringPresetBlock(platform);
+                if (block.enableWeakerNetworkIsolation !== undefined) {
+                    sandbox.enableWeakerNetworkIsolation = true;
+                }
+                else if (sandbox.enableWeakerNetworkIsolation !== undefined) {
+                    // Linux: the preset never touches trustd — a pre-existing local
+                    // trustd value is NORMALIZED OFF (never silently deleted), so the
+                    // local file keeps saying what it means.
+                    sandbox.enableWeakerNetworkIsolation = false;
+                }
+                if (block.network?.allowUnixSockets) {
+                    setTmpdirSockets(true);
+                    // Normalize a pre-existing broader door OFF: the macOS preset is
+                    // the NARROW shape, and a stale allowAllUnixSockets:true would
+                    // keep docker.sock open while the panel shows the narrow preset.
+                    network.allowAllUnixSockets = false;
+                }
+                if (block.network?.allowAllUnixSockets)
+                    network.allowAllUnixSockets = true;
+                network.allowLocalBinding = true;
+                break;
+            }
+            case "engineering-preset-off":
+                sandbox.enableWeakerNetworkIsolation = false;
+                network.allowAllUnixSockets = false;
+                network.allowLocalBinding = false;
+                setTmpdirSockets(false);
+                break;
+            case "trustd":
+            case "trustd-off":
+                sandbox.enableWeakerNetworkIsolation = choice === "trustd";
+                break;
+            case "unix-sockets":
+            case "unix-sockets-off": {
+                const on = choice === "unix-sockets";
+                if (platform === "darwin") {
+                    setTmpdirSockets(on);
+                }
+                else {
+                    network.allowAllUnixSockets = on;
+                }
+                break;
+            }
+            case "local-binding":
+            case "local-binding-off":
+                network.allowLocalBinding = choice === "local-binding";
+                break;
+        }
+        sandbox.network = network;
+        config.sandbox = sandbox;
+    }, "sandbox");
+}
 /**
  * Wait for a spawned child's exit without hanging on inherited stdio —
  * after exit, release the pipes after a short idle grace so a detached

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yagni-app/code-staging",
-  "version": "1.1.0-staging.1325.1",
+  "version": "1.1.0-staging.1327.1",
   "description": "YAGNI Code: a terminal coding agent that already knows your company. One YAGNI login routes the model and grounds the agent in your team's context.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "YAGNI, Inc. <jack@yagni.app> (https://yagni.app)",
@@ -58,5 +58,5 @@
     "turndown": "^7.2.4",
     "typebox": "^1.3.15"
   },
-  "yagniSourceSha": "0ba465bf11818ab831d132603f7dff64e5cf99c5"
+  "yagniSourceSha": "82e201e640d0f201b2e2a28a14b4259921086436"
 }