@yagni-app/code 1.0.6 → 1.0.8

package/dist/extension/sandbox/session.js

@@ -0,0 +1,829 @@
+/**
+ * Sandbox session wiring: owns the per-session YagniSandboxManager
+ * and hooks it into pi — bash tool re-registration with the sandbox
+ * spawnHook, user_bash (! commands) routing, session lifecycle, and the
+ * network ask flow (interactive prompt in TUI/RPC, fail-closed in
+ * print/headless).
+ *
+ * Registration model: the sandbox re-registers the bash tool ONLY when
+ * sandbox.enabled is true in the loaded settings — default-off sessions keep
+ * pi's stock bash byte-identical (a duplicate tool name is a hard 400 on
+ * some providers). /sandbox (M5) toggles by rewriting settings and asking
+ * for a session restart, the same way Claude persists the toggle.
+ */
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { Type } from "typebox";
+import { Key } from "@earendil-works/pi-tui";
+import { createBashToolDefinition, getShellConfig, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { logEvent } from "../errorSink.js";
+import { codeStateHome } from "../stateHome.js";
+import { isDebug } from "../diagnostics.js";
+import { mutateConfigJson, mutateLocalConfig } from "../settingsFiles.js";
+import { loadSandboxSettings } from "./config.js";
+import { annotateCommandOutput, makeSandboxSpawnHook, preWrappedCommand, shouldUseSandbox, shouldUseSandboxForUserCommand, } from "./bash.js";
+import { YagniSandboxManager } from "./manager.js";
+import { SandboxPanel, buildPanelState } from "./panel.js";
+import { effectiveRules } from "../permissionRules/loadConfig.js";
+/**
+ * Build the sandbox bash composition: given ANY stock bash definition (pi's
+ * own or condensedTools'), return the sandbox-aware version — schema gains
+ * dangerouslyDisableSandbox, execute wraps via the manager when the decision
+ * says so, and EPERM output is annotated. Identity when the sandbox is
+ * disabled at load time (default-off sessions stay byte-identical).
+ *
+ * Exported so condensedTools consumes it through its wrapBash seam — the
+ * M4 e2e lesson: condensed registers bash LAST, so a competing registration
+ * here would be overwritten and the sandbox would silently never reach
+ * model-driven tool calls.
+ */
+export function makeBashComposition(manager, settings, cwd) {
+    return (def) => {
+        if (!settings().enabled)
+            return def;
+        const userShellPath = SettingsManager.create(cwd).getShellPath();
+        const { shell: binShell } = getShellConfig(userShellPath);
+        const spawnHook = makeSandboxSpawnHook(manager);
+        const sandboxBash = createBashToolDefinition(cwd, {
+            shellPath: userShellPath,
+            spawnHook,
+        });
+        const schema = Type.Object({
+            command: Type.String({ description: "The bash command to execute" }),
+            timeout: Type.Optional(Type.Number({ description: "Optional timeout in seconds" })),
+            dangerouslyDisableSandbox: Type.Optional(Type.Boolean({
+                description: "Set true ONLY when you have evidence this exact command failed due to a sandbox restriction " +
+                    '("Operation not permitted", a denied path/host, unix-socket errors). The retry still goes ' +
+                    "through the normal permission flow. Default false; prefer working within the sandbox.",
+            })),
+        });
+        // Claude's getSimpleSandboxSection pattern: the model sees the RESOLVED
+        // restrictions inline, plus the retry protocol. Without this the model
+        // cannot distinguish sandbox denials from ordinary failures.
+        const s = settings();
+        const restrictions = [];
+        const allowed = s.network?.allowedDomains ?? [];
+        restrictions.push(allowed.length > 0
+            ? `Network: only these domains (wildcards ok): ${allowed.join(", ")}`
+            : "Network: no domains pre-allowed — the first contact to each host prompts the user");
+        restrictions.push(`Filesystem writes: working directory, /tmp, and paths granted by Edit(...) allow rules`);
+        if (s.filesystem?.denyWrite?.length)
+            restrictions.push(`Denied writes: ${s.filesystem.denyWrite.join(", ")}`);
+        const strictNote = s.allowUnsandboxedCommands === false
+            ? "All commands MUST run sandboxed — dangerouslyDisableSandbox is disabled by policy."
+            : "Default to running commands in the sandbox. Set dangerouslyDisableSandbox: true ONLY with evidence of a sandbox-caused failure (\"Operation not permitted\", denied path/host, unix-socket errors) — the retry still goes through the normal permission flow. The user can adjust restrictions with /sandbox.";
+        const wrapped = {
+            ...def,
+            description: `${def.description}\n\n## Command sandbox\nCommands run inside an OS sandbox: ${restrictions.join("; ")}. ${strictNote}`,
+            parameters: schema,
+            async execute(id, params, signal, onUpdate, ctx) {
+                const input = params;
+                const s = settings();
+                const useSandbox = shouldUseSandbox(input, manager, s);
+                logEvent({
+                    source: "sandbox",
+                    level: isDebug() ? "debug" : "info",
+                    event: "tool_execute_decision",
+                    fields: { useSandbox, initialized: manager.initialized, hasCommand: Boolean(input.command) },
+                });
+                if (!useSandbox) {
+                    return def.execute(id, params, signal, onUpdate, ctx);
+                }
+                const execParams = { ...input, command: await preWrappedCommand(manager, input.command, binShell) };
+                let result;
+                try {
+                    result = await sandboxBash.execute(id, execParams, signal, onUpdate, ctx);
+                }
+                catch (err) {
+                    if (err instanceof Error && err.message.includes("Operation not permitted")) {
+                        const annotated = annotateCommandOutput(manager, input.command, err.message);
+                        throw new Error(annotated);
+                    }
+                    throw err;
+                }
+                finally {
+                    manager.cleanupAfterCommand();
+                }
+                if (result?.content) {
+                    const text = result.content.map((c) => (c.type === "text" ? c.text : "")).join("\n");
+                    if (text.includes("Operation not permitted")) {
+                        const annotated = annotateCommandOutput(manager, input.command, text);
+                        result = { ...result, content: [{ type: "text", text: annotated }] };
+                    }
+                }
+                return result;
+            },
+        };
+        return wrapped;
+    };
+}
+/**
+ * Register the sandbox surfaces on the ExtensionAPI. Returns the session
+ * handle (manager + accessors) or null when the platform can never run the
+ * sandbox (no-op registration, stock bash stays).
+ */
+export function registerSandbox(pi, opts) {
+    const platform = process.platform;
+    if (platform !== "darwin" && platform !== "linux")
+        return null;
+    const load = () => loadSandboxSettings({
+        cwd: opts.cwd,
+        env: opts.env,
+        userHome: opts.userHome,
+        stateHomeOverride: opts.stateHomeOverride,
+    }).settings;
+    let currentSettings = load();
+    let rules = [];
+    // Optional-chained: some harnesses/mocks don't implement flag APIs; the
+    // flag simply reads as unset there. Real pi registers it normally.
+    pi.registerFlag?.("no-sandbox", {
+        description: "Disable OS-level sandboxing for bash commands (this session)",
+        type: "boolean",
+        default: false,
+    });
+    // Read LAZILY (per session_start), never at registration: pi applies
+    // extension flag values AFTER extension load (applyExtensionFlagValues in
+    // agent-session-services), so an eager read at registration time always
+    // sees unset — the flag would be silently dead.
+    const noSandboxFlag = () => pi.getFlag?.("no-sandbox") === true;
+    /** Session-level toggle state: null = follow config; false = forced off. */
+    let sessionToggle = null;
+    // The session's RESOLVED state home (override-aware) — every persist
+    // writes here, never a raw codeStateHome(process.env) that would ignore
+    // isolation (the test-leak lesson).
+    const resolvedStateHome = opts.stateHomeOverride ?? codeStateHome(null, opts.env, opts.userHome);
+    const manager = opts.makeManager
+        ? opts.makeManager({
+            cwd: opts.cwd,
+            env: opts.env,
+            userHome: opts.userHome,
+            stateHomeOverride: opts.stateHomeOverride,
+            projectRoot: opts.projectRoot,
+            rgPath: opts.rgPath,
+        })
+        : new YagniSandboxManager({
+            cwd: opts.cwd,
+            env: opts.env,
+            userHome: opts.userHome,
+            stateHomeOverride: opts.stateHomeOverride,
+            projectRoot: opts.projectRoot,
+            rgPath: opts.rgPath,
+        });
+    // The network ask fires from INSIDE a bash execution (srt's proxy at
+    // connect time) — no event ctx in scope. The UI bridge is captured from
+    // the most recent tool_call / session_start ctx (same bridge all session)
+    // and held here; RPC dialogs and TUI prompts both work through it.
+    let uiBridge = null;
+    const captureUi = (ctx) => {
+        if (ctx?.ui)
+            uiBridge = ctx;
+    };
+    // Trust snapshot for the sandbox rule merge (D3): an untrusted repo's
+    // committed allow rules (project OR local) must not widen the OS-level
+    // allowWrite/deniedDomains sets — the same filtering the permission gate
+    // applies. Captured from the latest ctx; defaults trusted (parity with
+    // the gate's fail-open posture on a missing isProjectTrusted).
+    let trustedSnapshot = true;
+    const captureTrust = (ctx) => {
+        try {
+            if (typeof ctx?.isProjectTrusted === "function")
+                trustedSnapshot = ctx.isProjectTrusted();
+        }
+        catch (err) {
+            // Keep the prior snapshot (fail-open parity with the gate) but make
+            // the throw VISIBLE: warn (not debug) — readSessionTrail filters debug
+            // lines, so a debug event would never reach /feedback; a trust-probe
+            // failure silently pinning the wrong posture must be surfacable.
+            // Scrub-safe: error class only, no thrown message.
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "trust_probe_failed",
+                fields: { error: err instanceof Error ? err.constructor.name : typeof err },
+            });
+        }
+    };
+    /** Rules filtered to what the sandbox may enforce OS-wide (trust-aware). */
+    const effectiveRulesForSandbox = () => effectiveRules(rules, trustedSnapshot);
+    const sessionDomainGrants = new Set();
+    const askHandler = async (host) => {
+        if (sessionDomainGrants.has(host))
+            return true;
+        const ui = uiBridge;
+        if (!ui?.hasUI)
+            return false; // headless: fail closed (never grant silently)
+        if (ui.signal?.aborted)
+            return false;
+        // Claude-parity grant options. Session grant is memory-only and
+        // agent-invisible; project/user write the sandbox config file.
+        const dialogOpts = {
+            title: `Sandbox: allow network access to ${host}?`,
+            timeout: 600_000,
+            ...(ui.signal ? { signal: ui.signal } : {}),
+        };
+        let choice;
+        try {
+            choice = await ui.ui.select(`Sandbox: allow network access to ${host}?`, [
+                "Allow for this session",
+                `Allow for this project (.yagni-code/config.json)`,
+                `Allow for all projects (~/.yagni-code/config.json)`,
+                "Block",
+            ], dialogOpts);
+        }
+        catch {
+            return false; // dialog error / timeout: never grant
+        }
+        if (choice === undefined || choice === "Block")
+            return false;
+        sessionDomainGrants.add(host);
+        if (choice.startsWith("Allow for this project")) {
+            try {
+                persistDomainGrant(opts.projectRoot ?? opts.cwd, host, resolvedStateHome);
+            }
+            catch (err) {
+                // fail-soft: the session grant already holds; the persistence just
+                // did not — the user chose it, so surface it (notify + sink, same
+                // posture as persistToggleAndNotify) rather than stay silent.
+                logGrantPersistFailure(host, "project", err);
+                ui.ui.notify?.("Could not persist the domain grant to the config file — it applies to this session only.", "warning");
+            }
+        }
+        else if (choice.startsWith("Allow for all projects")) {
+            try {
+                persistDomainGrant(null, host, resolvedStateHome);
+            }
+            catch (err) {
+                logGrantPersistFailure(host, "user", err);
+                ui.ui.notify?.("Could not persist the domain grant to the config file — it applies to this session only.", "warning");
+            }
+        }
+        // The grant must reach the live srt config before the retry.
+        manager.refreshConfig([...effectiveRulesForSandbox()]);
+        return true;
+    };
+    // --- bash composition ---
+    // ONE wrapped bash definition, built once and consumed by whichever site
+    // registers bash for this session: condensedTools' wrapBash seam (the
+    // common path — condensed registers LAST and would otherwise overwrite a
+    // competing registration, the M4 e2e lesson) or this module's own
+    // registration when condensed is inactive (eval mode, classic rows,
+    // desktop). The composition is identity when the sandbox is disabled —
+    // default-off sessions stay byte-identical.
+    const composeBash = makeBashComposition(manager, () => currentSettings, opts.cwd);
+    const registerOwnBash = () => {
+        if (!currentSettings.enabled)
+            return;
+        const userShellPath = SettingsManager.create(opts.cwd).getShellPath();
+        const stockBash = createBashToolDefinition(opts.cwd, { shellPath: userShellPath });
+        pi.registerTool(composeBash(stockBash));
+    };
+    const handle = {
+        manager,
+        settings: () => currentSettings,
+        setRules: (r) => {
+            rules = r;
+        },
+        grantDomainSession: (domain) => {
+            sessionDomainGrants.add(domain);
+            manager.refreshConfig([...effectiveRulesForSandbox()]);
+        },
+        sessionDomains: () => [...sessionDomainGrants],
+        composeBash,
+        registerOwnBash,
+    };
+    // --- user_bash (! commands): identical OS treatment to tool calls ---
+    // pi executes the user's command through the returned BashOperations, so
+    // wrapping at this seam gives ! commands the same sandbox. Process-group
+    // kill + stdio handling derived from pi-sandbox (MIT, carderne/pi-sandbox
+    // src/sandbox-runtime.ts, waitForChildProcess) with pi's local ops as the
+    // behavioral reference.
+    pi.on("user_bash", async (event) => {
+        if (!shouldUseSandboxForUserCommand(event.command, manager, currentSettings))
+            return;
+        const { shell, args } = getShellConfig(SettingsManager.create(opts.cwd).getShellPath());
+        const operations = {
+            exec: async (command, cwd, { onData, signal, timeout, env }) => {
+                if (!existsSync(cwd))
+                    throw new Error(`Working directory does not exist: ${cwd}`);
+                const wrapped = await manager.wrapWithSandbox(command, shell);
+                const child = spawn(shell, [...args, wrapped], {
+                    cwd,
+                    env: env ?? process.env,
+                    detached: true,
+                    stdio: ["ignore", "pipe", "pipe"],
+                });
+                let timedOut = false;
+                let timeoutHandle;
+                const killGroup = () => {
+                    if (!child.pid)
+                        return;
+                    try {
+                        process.kill(-child.pid, "SIGKILL");
+                    }
+                    catch {
+                        child.kill("SIGKILL");
+                    }
+                };
+                if (timeout !== undefined && timeout > 0) {
+                    timeoutHandle = setTimeout(() => { timedOut = true; killGroup(); }, timeout * 1000);
+                }
+                child.stdout?.on("data", onData);
+                child.stderr?.on("data", onData);
+                signal?.addEventListener("abort", killGroup, { once: true });
+                try {
+                    const exitCode = await waitForChildProcess(child);
+                    if (signal?.aborted)
+                        throw new Error("aborted");
+                    if (timedOut)
+                        throw new Error(`timeout:${timeout}`);
+                    return { exitCode };
+                }
+                finally {
+                    if (timeoutHandle)
+                        clearTimeout(timeoutHandle);
+                    signal?.removeEventListener("abort", killGroup);
+                    manager.cleanupAfterCommand();
+                }
+            },
+        };
+        return { operations };
+    });
+    // --- session lifecycle ---
+    // The UI bridge is captured on every ctx-bearing event so the network ask
+    // (fired from inside bash execution, no event ctx) can prompt.
+    pi.on("tool_call", async (_event, ctx) => {
+        captureUi(ctx);
+        captureTrust(ctx);
+        return;
+    });
+    pi.on("session_start", async (_event, ctx) => {
+        captureUi(ctx);
+        captureTrust(ctx);
+        currentSettings = load();
+        // --no-sandbox skips init in EVERY mode — headless included. The notify
+        // is UI-gated, the SKIP never is (a UI-only skip would silently keep the
+        // sandbox on for scripted runs that asked it off).
+        if (noSandboxFlag()) {
+            if (opts.hasUI(ctx))
+                ctx.ui.notify("Sandbox disabled via --no-sandbox for this session", "warning");
+            return;
+        }
+        if (!currentSettings.enabled)
+            return;
+        manager.setAskHandler(askHandler);
+        const err = await manager.initialize(effectiveRulesForSandbox());
+        if (err) {
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "init_failed",
+                fields: { reason: err },
+            });
+            if (currentSettings.failIfUnavailable) {
+                ctx.ui.notify(`Sandbox required by config but unavailable: ${err}. Refusing to run — fix dependencies or disable sandbox.enabled.`, "error");
+                throw new Error(`sandbox unavailable (failIfUnavailable): ${err}`);
+            }
+            ctx.ui.notify(`Sandbox unavailable, commands run unsandboxed: ${err}`, "warning");
+            return;
+        }
+        if (ctx.hasUI) {
+            ctx.ui.setStatus?.("sandbox", "sandbox on");
+        }
+        logEvent({ source: "sandbox", level: "info", event: "initialized", fields: { platform } });
+    });
+    pi.on("session_shutdown", async () => {
+        await manager.reset();
+    });
+    // --- /sandbox command + toggle surfaces ---
+    const formatConfigSummary = () => {
+        const s = currentSettings;
+        const lines = [
+            `enabled: ${s.enabled ? "yes" : "no"}${sessionToggle === false ? " (toggled off this session)" : ""}`,
+            `autoAllowBashIfSandboxed: ${s.autoAllowBashIfSandboxed !== false ? "yes" : "no"}`,
+            `allowUnsandboxedCommands: ${s.allowUnsandboxedCommands !== false ? "yes" : "no (strict)"}`,
+        ];
+        if (s.network?.allowedDomains?.length)
+            lines.push(`allowedDomains: ${s.network.allowedDomains.join(", ")}`);
+        else
+            lines.push("allowedDomains: (none — first contact prompts)");
+        if (s.network?.deniedDomains?.length)
+            lines.push(`deniedDomains: ${s.network.deniedDomains.join(", ")}`);
+        if (s.network?.allowLocalBinding)
+            lines.push("allowLocalBinding: yes (loopback + private ranges)");
+        if (s.filesystem?.allowWrite?.length)
+            lines.push(`allowWrite: ${s.filesystem.allowWrite.join(", ")}`);
+        if (s.filesystem?.denyWrite?.length)
+            lines.push(`denyWrite: ${s.filesystem.denyWrite.join(", ")}`);
+        if (s.filesystem?.denyRead?.length)
+            lines.push(`denyRead: ${s.filesystem.denyRead.join(", ")}`);
+        if (sessionDomainGrants.size > 0)
+            lines.push(`session grants: ${[...sessionDomainGrants].join(", ")} (memory-only)`);
+        if (s.excludedCommands?.length)
+            lines.push(`excludedCommands: ${s.excludedCommands.join(", ")}`);
+        return lines;
+    };
+    /**
+     * Session-level toggle. OFF is always immediate (manager.reset unwraps the
+     * next command) and — when the session started ENABLED — PERSISTS the
+     * disable to the local config (Claude's toggle persists both directions).
+     * ON is split by how the session started:
+     *  - config-enabled session: re-initialize (force past nothing — it was on)
+     *  - default-off session: the wrapped bash may not have registered at load
+     *    (condensedTools owns the registration in the common TUI and reads disk
+     *    settings, not this session's toggle). So /sandbox enable PERSISTS
+     *    sandbox.enabled=true to the local config (Claude's own panel persists
+     *    its mode choice the same way) and asks for a restart — the honest
+     *    behavior; a silent no-op would be a security lie.
+     */
+    /** Persist-or-notify for the enable/disable toggles — keeps
+     * setSessionToggle flat: try the local write, return the success notice
+     * on success or the failure notice on throw (the caller decides level +
+     * side effects like the sessionToggle reset). A failed persist also logs
+     * sandbox_persist_failed with the thrown message (path/reason text from
+     * mutateConfigJson) — same diagnosability posture as rule_save_failed. */
+    const persistToggleAndNotify = (enabled, ctx) => {
+        try {
+            persistEnabledFlip(enabled, opts.cwd);
+            return {
+                ok: true,
+                notice: enabled
+                    ? "Sandbox enabled in .yagni-code/config.local.json — restart the session (or /new) to apply it to the model's bash tool. Your ! commands are NOT sandboxed until then."
+                    : "Sandbox disabled for this session and set to off in .yagni-code/config.local.json",
+            };
+        }
+        catch (err) {
+            logEvent({
+                source: "sandbox",
+                level: "warn",
+                event: "sandbox_persist_failed",
+                fields: {
+                    enabled,
+                    error: err instanceof Error ? err.message : String(err),
+                },
+            });
+            return {
+                ok: false,
+                notice: enabled
+                    ? 'Could not write the sandbox enable to .yagni-code/config.local.json — set "sandbox": { "enabled": true } there and restart.'
+                    : "Sandbox disabled for this session (could not persist the off state to config.local.json — a restart may re-arm it)",
+            };
+        }
+    };
+    const setSessionToggle = async (on, ctx) => {
+        sessionToggle = on;
+        if (on) {
+            const startedEnabled = load().enabled;
+            if (startedEnabled) {
+                const err = await manager.initialize(effectiveRulesForSandbox(), { force: true });
+                if (err) {
+                    ctx.ui.notify(`Sandbox unavailable: ${err}`, "error");
+                    sessionToggle = null;
+                    return;
+                }
+                // NO registerOwnBash here: on a condensed-active session (the common
+                // case for a config-enabled start) condensed owns the bash
+                // registration and composed the wrap at load; re-initializing the
+                // manager is all the toggle needs — composeBash reads the manager
+                // live at execution time. Registering a stock-wrapped bash here
+                // would REPLACE condensed's registration and silently degrade the
+                // transcript renderer for the rest of the session.
+                ctx.ui.setStatus?.("sandbox", "sandbox on");
+                ctx.ui.notify("Sandbox enabled for this session", "info");
+            }
+            else {
+                // Persist the enable (fail-soft: on write failure tell the user to
+                // edit the file — never claim success falsely).
+                const r = persistToggleAndNotify(true, ctx);
+                if (r.ok) {
+                    ctx.ui.setStatus?.("sandbox", "sandbox on (restart to apply)");
+                    ctx.ui.notify(r.notice, "warning");
+                }
+                else {
+                    ctx.ui.notify(r.notice, "error");
+                    sessionToggle = null;
+                }
+            }
+        }
+        else {
+            await manager.reset();
+            ctx.ui.setStatus?.("sandbox", "");
+            // Persist the disable when the session started enabled — a restart
+            // must not silently re-arm the sandbox the user just turned off.
+            // Fail-soft: the session-level reset above already applies NOW.
+            if (load().enabled) {
+                const r = persistToggleAndNotify(false, ctx);
+                // Error (not warning): a failed off-persist silently re-arms the
+                // sandbox on restart — the security-relevant direction, at least as
+                // loud as the enable failure.
+                ctx.ui.notify(r.notice, r.ok ? "warning" : "error");
+            }
+            else {
+                ctx.ui.notify("Sandbox disabled for this session", "warning");
+            }
+        }
+    };
+    /**
+     * The interactive /sandbox panel (TUI only). Selections persist to the
+     * PROJECT-LOCAL config (.yagni-code/config.local.json — the personal
+     * per-project tier, Claude Code's own panel destination); the
+     * confirmation message is surfaced via notify after the panel closes,
+     * mirroring Claude's onComplete flow. enable-from-default-off keeps the
+     * honest restart advice.
+     */
+    const openSandboxPanel = async (ctx) => {
+        const deps = manager.checkDependencies();
+        const state = buildPanelState(currentSettings, sessionToggle === false, effectiveRulesForSandbox(), {
+            cwd: opts.cwd,
+            userStateHome: resolvedStateHome,
+            projectRoot: opts.projectRoot ?? null,
+            homeDir: opts.userHome,
+        }, [...sessionDomainGrants], deps);
+        const actions = {
+            onModeSelect: async (choice) => {
+                const wasEnabled = load().enabled === true;
+                try {
+                    persistSandboxMode(choice, opts.cwd);
+                }
+                catch {
+                    return {
+                        text: `Could not write the sandbox setting to .yagni-code/config.local.json — edit it directly ("sandbox": { "enabled": ${choice !== "disabled"} }) and restart.`,
+                        level: "error",
+                    };
+                }
+                currentSettings = load();
+                if (choice === "disabled") {
+                    await manager.reset();
+                    sessionToggle = false;
+                    ctx.ui.setStatus?.("sandbox", "");
+                    return { text: "○ Sandbox disabled", level: "info" };
+                }
+                const message = choice === "auto-allow"
+                    ? "✓ Sandbox enabled with auto-allow for bash commands"
+                    : "✓ Sandbox enabled with regular bash permissions";
+                if (!wasEnabled) {
+                    // Same honesty as setSessionToggle's enable path: the session's
+                    // wrapped bash registered (or didn't) at load; a restart applies
+                    // the new mode to the model's bash tool.
+                    ctx.ui.setStatus?.("sandbox", "sandbox on (restart to apply)");
+                    return {
+                        text: `${message} — saved to project-local settings (.yagni-code/config.local.json); restart the session (or /new) to apply it to the model's bash tool.`,
+                        level: "info",
+                    };
+                }
+                // Already-enabled session changing autoAllow only: refresh the
+                // live merge so the next bash call sees the new decision posture.
+                if (manager.initialized)
+                    manager.refreshConfig(effectiveRulesForSandbox());
+                ctx.ui.setStatus?.("sandbox", "sandbox on");
+                return {
+                    text: `${message} — saved to project-local settings (.yagni-code/config.local.json).`,
+                    level: "info",
+                };
+            },
+            onOverrideSelect: async (choice) => {
+                try {
+                    persistSandboxOverride(choice, opts.cwd);
+                }
+                catch {
+                    return {
+                        text: `Could not write the sandbox override to .yagni-code/config.local.json — edit it directly ("sandbox": { "allowUnsandboxedCommands": ... }) and restart.`,
+                        level: "error",
+                    };
+                }
+                currentSettings = load();
+                if (manager.initialized)
+                    manager.refreshConfig(effectiveRulesForSandbox());
+                return {
+                    text: choice === "open"
+                        ? "✓ Unsandboxed fallback allowed — commands can run outside the sandbox when necessary — saved to project-local settings"
+                        : "✓ Strict sandbox mode — all commands must run in the sandbox or be excluded via the excludedCommands option — saved to project-local settings",
+                    level: "info",
+                };
+            },
+        };
+        let outcome;
+        try {
+            outcome = await ctx.ui.custom((tui, theme, keybindings, done) => {
+                void tui;
+                void keybindings;
+                return new SandboxPanel(state, actions, theme, (o) => done(o ?? null));
+            });
+        }
+        catch {
+            // custom() unavailable (harness without TUI) — fall through to notify.
+        }
+        // null = closed without a selection (Esc / cancel): no message, no
+        // summary dump. undefined = custom() never ran (RPC): text summary.
+        if (outcome) {
+            ctx.ui.notify(outcome.text, outcome.level);
+            return;
+        }
+        if (outcome === undefined) {
+            ctx.ui.notify(["Sandbox configuration:", ...formatConfigSummary().map((l) => `  ${l}`)].join("\n"), "info");
+        }
+    };
+    pi.registerCommand("sandbox", {
+        description: "Show sandbox configuration / manage the session toggle",
+        handler: async (args, ctx) => {
+            const trimmed = args.trim();
+            if (trimmed === "enable")
+                return setSessionToggle(true, ctx);
+            if (trimmed === "disable")
+                return setSessionToggle(false, ctx);
+            if (trimmed === "exclude" || trimmed.startsWith("exclude ")) {
+                // /sandbox exclude "npm run test:*" — convenience escape valve (the
+                // permission gate remains the security boundary).
+                const pattern = trimmed.slice("exclude ".length).trim().replace(/^["']|["']$/g, "");
+                if (!pattern) {
+                    ctx.ui.notify("Usage: /sandbox exclude <command-pattern>", "error");
+                    return;
+                }
+                currentSettings = { ...currentSettings, excludedCommands: [...(currentSettings.excludedCommands ?? []), pattern] };
+                ctx.ui.notify(`Excluded "${pattern}" from sandboxing for this session`, "info");
+                return;
+            }
+            // TUI: the interactive tabbed panel (Claude's /sandbox). RPC/headless:
+            // custom() is unavailable there — keep the text summary.
+            if (ctx.mode === "tui" && ctx.hasUI) {
+                return openSandboxPanel(ctx);
+            }
+            ctx.ui.notify(["Sandbox configuration:", ...formatConfigSummary().map((l) => `  ${l}`)].join("\n"), "info");
+        },
+    });
+    pi.registerShortcut?.(Key.alt("s"), {
+        description: "Toggle the bash sandbox for this session",
+        handler: (ctx) => {
+            void setSessionToggle((sessionToggle ?? manager.initialized) === false, ctx);
+        },
+    });
+    return handle;
+}
+/**
+ * Persist a domain grant to the user or project sandbox config (fail-soft:
+ * the session grant already applies even if the write fails).
+ */
+/** Local helper for the grant/target writers below (shared shape). */
+function isPlainRecord(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+/** Sink line for a failed domain-grant persist — the thrown message is
+ * mutateConfigJson's own path/reason text (diagnosable, no file content),
+ * same posture as sandbox_persist_failed / rule_save_failed. */
+function logGrantPersistFailure(host, scope, err) {
+    logEvent({
+        source: "sandbox",
+        level: "warn",
+        event: "sandbox_persist_failed",
+        fields: {
+            grant: host,
+            scope,
+            error: err instanceof Error ? err.message : String(err),
+        },
+    });
+}
+/** Persist a domain grant to the user or project sandbox config. */
+function persistDomainGrant(projectRoot, domain, stateHome) {
+    const target = projectRoot
+        ? join(projectRoot, ".yagni-code", "config.json")
+        : join(stateHome, "config.json");
+    mutateConfigJson(target, (config) => {
+        const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
+        const network = isPlainRecord(sandbox.network) ? { ...sandbox.network } : {};
+        const domains = Array.isArray(network.allowedDomains) ? [...network.allowedDomains] : [];
+        if (!domains.includes(domain))
+            domains.push(domain);
+        network.allowedDomains = domains;
+        sandbox.network = network;
+        config.sandbox = sandbox;
+    });
+}
+/**
+ * Persist sandbox.enabled to the PROJECT-LOCAL config — the personal
+ * per-project tier, Claude Code's own destination for these writes
+ * (settings.local.json). Local writes fire-and-forget the global-gitignore
+ * helper so the file is never committed by accident.
+ */
+function persistEnabledFlip(enabled, cwd) {
+    mutateLocalConfig(cwd, (config) => {
+        const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
+        sandbox.enabled = enabled;
+        config.sandbox = sandbox;
+    }, "sandbox");
+}
+/**
+ * Persist a panel Mode choice (enabled + autoAllowBashIfSandboxed pair) to
+ * the PROJECT-LOCAL config — Claude Code's own panel persists its mode
+ * choice to settings.local.json; ours now matches. Also fire-and-forgets
+ * the global-gitignore helper on first write.
+ */
+function persistSandboxMode(choice, cwd) {
+    mutateLocalConfig(cwd, (config) => {
+        const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
+        if (choice === "auto-allow") {
+            sandbox.enabled = true;
+            sandbox.autoAllowBashIfSandboxed = true;
+        }
+        else if (choice === "regular") {
+            sandbox.enabled = true;
+            sandbox.autoAllowBashIfSandboxed = false;
+        }
+        else {
+            sandbox.enabled = false;
+            sandbox.autoAllowBashIfSandboxed = false;
+        }
+        config.sandbox = sandbox;
+    }, "sandbox");
+}
+/** Persist a panel Overrides choice (allowUnsandboxedCommands) — same
+ * destination + honesty contract as persistSandboxMode. */
+function persistSandboxOverride(choice, cwd) {
+    mutateLocalConfig(cwd, (config) => {
+        const sandbox = isPlainRecord(config.sandbox) ? { ...config.sandbox } : {};
+        sandbox.allowUnsandboxedCommands = choice === "open";
+        config.sandbox = sandbox;
+    }, "sandbox");
+}
+/**
+ * Wait for a spawned child's exit without hanging on inherited stdio —
+ * after exit, release the pipes after a short idle grace so a detached
+ * descendant holding them open cannot wedge the await. Derived from
+ * pi-sandbox (MIT) waitForChildProcess.
+ */
+const EXIT_STDIO_GRACE_MS = 100;
+function waitForChildProcess(child) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let exited = false;
+        let exitCode = null;
+        let postExitTimer;
+        let stdoutEnded = child.stdout === null;
+        let stderrEnded = child.stderr === null;
+        const cleanup = () => {
+            if (postExitTimer)
+                clearTimeout(postExitTimer);
+            child.removeListener("error", onError);
+            child.removeListener("exit", onExit);
+            child.removeListener("close", onClose);
+            child.stdout?.removeListener("end", onStdoutEnd);
+            child.stderr?.removeListener("end", onStderrEnd);
+            child.stdout?.removeListener("data", onData);
+            child.stderr?.removeListener("data", onData);
+        };
+        const finalize = (code) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            child.stdout?.destroy();
+            child.stderr?.destroy();
+            resolve(code);
+        };
+        const maybeFinalizeAfterExit = () => {
+            if (!exited || settled)
+                return;
+            if (stdoutEnded && stderrEnded)
+                finalize(exitCode);
+        };
+        const armIdleTimer = () => {
+            if (postExitTimer)
+                clearTimeout(postExitTimer);
+            postExitTimer = setTimeout(() => finalize(exitCode), EXIT_STDIO_GRACE_MS);
+        };
+        const onData = () => {
+            if (exited && !settled)
+                armIdleTimer();
+        };
+        const onStdoutEnd = () => {
+            stdoutEnded = true;
+            maybeFinalizeAfterExit();
+        };
+        const onStderrEnd = () => {
+            stderrEnded = true;
+            maybeFinalizeAfterExit();
+        };
+        const onError = (error) => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(error);
+        };
+        const onExit = (code) => {
+            exited = true;
+            exitCode = code;
+            maybeFinalizeAfterExit();
+            if (!settled)
+                armIdleTimer();
+        };
+        const onClose = (code) => finalize(code);
+        child.stdout?.once("end", onStdoutEnd);
+        child.stderr?.once("end", onStderrEnd);
+        child.stdout?.on("data", onData);
+        child.stderr?.on("data", onData);
+        child.once("error", onError);
+        child.once("exit", onExit);
+        child.once("close", onClose);
+    });
+}
+//# sourceMappingURL=session.js.map