chainlesschain 0.162.142 → 0.162.147

package/src/runtime/agent-core.js

@@ -44,6 +44,7 @@ import { createToolContext } from "../tools/tool-context.js";
 import { createToolTelemetryRecord } from "../tools/tool-telemetry.js";
 import { isAbortError, throwIfAborted } from "../lib/abort-utils.js";
 import { buildSearchCommand } from "../lib/search-command.js";
+import { discoverCommands } from "../lib/slash-commands.js";
 import {
   isRetryableStreamError,
   STREAM_RETRY_BASE_MS,
@@ -700,6 +701,30 @@ export function buildSystemPrompt(cwd, opts = {}) {
       extraDirs.map((d) => `- ${d}`).join("\n");
   }
 
+  // Advertise user-defined slash commands (.claude/commands/*.md etc.) so the
+  // model knows which prompt macros it can run via the slash_command tool.
+  try {
+    const macros = discoverCommands(dir);
+    if (macros.length > 0) {
+      prompt +=
+        `\n\n## Available slash commands\n` +
+        `These are reusable prompt macros the user has defined. Run one with ` +
+        `the slash_command tool (e.g. {"command":"/${macros[0].name}"}) when it ` +
+        `fits the task; the tool returns the command's expanded instructions ` +
+        `for you to carry out.\n` +
+        macros
+          .map(
+            (m) =>
+              `- /${m.name}` +
+              (m.argumentHint ? ` ${m.argumentHint}` : "") +
+              (m.description ? ` — ${m.description}` : ""),
+          )
+          .join("\n");
+    }
+  } catch {
+    // Non-critical — command discovery failure must not break the prompt.
+  }
+
   return prompt;
 }
 
@@ -1272,6 +1297,7 @@ export async function executeTool(name, args, context = {}) {
       approvalGate: context.approvalGate || null,
       shellConfirm: context.shellConfirm || null,
       additionalDirectories: context.additionalDirectories || null,
+      sandbox: context.sandbox || null,
       ruleAllowed,
       subAgentDepth: context.subAgentDepth || 0,
       subAgentBudget: context.subAgentBudget || null,
@@ -1686,6 +1712,7 @@ async function executeToolInner(
     approvalGate,
     shellConfirm,
     additionalDirectories,
+    sandbox,
     ruleAllowed = false,
     subAgentDepth = 0,
     subAgentBudget = null,
@@ -1993,6 +2020,13 @@ async function executeToolInner(
       // polls output + completion via check_shell. No timeout — that's the whole
       // point of backgrounding (builds, test suites, dev servers).
       if (args.run_in_background === true) {
+        if (sandbox) {
+          return attachDescriptor({
+            error:
+              "[Sandbox] Background shell tasks are not supported in the ephemeral sandbox. Run in the foreground or explicitly disable --sandbox.",
+            policy: { decision: "deny", via: "sandbox" },
+          });
+        }
         // Free memory from idle background tasks before adding another, so a
         // long agent run can't accumulate forgotten dev servers (no-op unless
         // the machine is actually under memory pressure).
@@ -2088,6 +2122,50 @@ async function executeToolInner(
         );
       }
 
+      if (sandbox) {
+        const { executeSandboxedShell, sandboxSummary } =
+          await import("../lib/agent-sandbox.js");
+        const result = executeSandboxedShell(args.command, sandbox, {
+          cwd: args.cwd || cwd,
+          timeout: _resolveShellTimeout(args.timeout),
+          maxBuffer: 1024 * 1024,
+          env: {
+            CLAUDECODE: "1",
+            ...(sessionId
+              ? {
+                  CC_SESSION_ID: String(sessionId),
+                  CLAUDE_CODE_SESSION_ID: String(sessionId),
+                }
+              : {}),
+          },
+        });
+        const common = {
+          sandbox: sandboxSummary(sandbox),
+          shellCommandPolicy: shellPolicy,
+          approval: approvalOutcome,
+          policyTrace: ["shell-policy", "approval", "sandbox"],
+        };
+        if (result.exitCode !== 0) {
+          return attachDescriptor(
+            {
+              error: (
+                result.stderr ||
+                `Sandbox command exited with code ${result.exitCode}`
+              ).substring(0, 2000),
+              stdout: result.stdout.substring(0, 30000),
+              stderr: result.stderr.substring(0, 2000),
+              exitCode: result.exitCode,
+              ...common,
+            },
+            override || runtimeDescriptor,
+          );
+        }
+        return attachDescriptor(
+          { stdout: result.stdout.substring(0, 30000), ...common },
+          override || runtimeDescriptor,
+        );
+      }
+
       try {
         const output = execSync(args.command, {
           cwd: args.cwd || cwd,
@@ -2348,6 +2426,59 @@ async function executeToolInner(
       }
     }
 
+    case "slash_command": {
+      try {
+        const { getCommand, expandCommand, discoverCommands } =
+          await import("../lib/slash-commands.js");
+        const raw = String(args.command || "").trim();
+        if (!raw) {
+          return attachDescriptor({
+            error: "slash_command requires a non-empty 'command'.",
+          });
+        }
+        // Parse "/name arg1 arg2" exactly like a typed slash command (leading
+        // '/' optional). First token is the command name, the rest are args.
+        const [head, ...rest] = raw.replace(/^\//, "").split(/\s+/);
+        const macro = head ? getCommand(head, cwd) : null;
+        if (!macro) {
+          const available = discoverCommands(cwd).map((c) => ({
+            name: c.name,
+            scope: c.scope,
+            description: c.description || undefined,
+          }));
+          return attachDescriptor({
+            error: `Unknown slash command "${head}".`,
+            availableCommands: available,
+            hint:
+              available.length === 0
+                ? "No user-defined slash commands found in .claude/commands/ or .chainlesschain/commands/."
+                : "Call slash_command with one of availableCommands[].name.",
+          });
+        }
+        // allowBang:false — the agent must not get an un-gated shell side
+        // channel via a command file. $ARGUMENTS / @file (read) still expand;
+        // any !`cmd` is left literal for the model to run via run_shell.
+        const { prompt: expanded, warnings } = expandCommand(
+          macro,
+          rest.filter(Boolean),
+          { cwd, allowBang: false },
+        );
+        return attachDescriptor({
+          command: macro.name,
+          scope: macro.scope,
+          expandedPrompt: expanded,
+          warnings: warnings && warnings.length ? warnings : undefined,
+          instructions:
+            "The expandedPrompt is the command's instructions. Carry them out " +
+            "now using your normal tools.",
+        });
+      } catch (err) {
+        return attachDescriptor({
+          error: `slash_command failed: ${err.message}`,
+        });
+      }
+    }
+
     case "ask_user_question": {
       if (!interaction || typeof interaction.askUser !== "function") {
         return attachDescriptor({
@@ -4633,6 +4764,7 @@ export async function* agentLoop(messages, options) {
     // false so run_code keeps its existing per-permission-mode behavior.
     interactiveApproval: options.interactiveApproval || false,
     additionalDirectories: options.additionalDirectories || null,
+    sandbox: options.sandbox || null,
     permissionRules: options.permissionRules || null,
     permissionConfirm: options.permissionConfirm || null,
     settingsHooks: options.settingsHooks || null,
@@ -5091,7 +5223,11 @@ export async function* agentLoop(messages, options) {
       });
       for (const { call, toolArgs, promise } of inflight) {
         throwIfAborted(signal);
-        yield { type: "tool-executing", tool: call.function.name, args: toolArgs };
+        yield {
+          type: "tool-executing",
+          tool: call.function.name,
+          args: toolArgs,
+        };
         const { result: toolResult, error: toolError } = await promise;
         throwIfAborted(signal);
         const warningMsg = budget.toWarningMessage();

package/src/runtime/coding-agent-contract-shared.cjs

@@ -653,6 +653,43 @@ const CODING_AGENT_TOOL_CONTRACTS = Object.freeze([
       tags: ["tool:todo_write", "contract:coding-agent", "tier:extension"],
     },
   },
+  {
+    name: "slash_command",
+    title: "Slash Command",
+    kind: "planning",
+    tier: "extension",
+    description:
+      "Run a user-defined slash command (a reusable prompt macro from " +
+      ".claude/commands/*.md or .chainlesschain/commands/*.md) and get back its " +
+      "expanded prompt text to act on. The 'command' string is the slash " +
+      "command exactly as a user would type it, e.g. '/review' or " +
+      "'/git:commit fix the typo' — the leading slash is optional and trailing " +
+      "words become $ARGUMENTS / $1..$9. @file references are expanded; " +
+      "!`shell` snippets are NOT executed when invoked this way (run them via " +
+      "run_shell if needed). Available commands are listed in the system " +
+      "prompt; calling with an unknown command returns the list.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        command: {
+          type: "string",
+          description:
+            "The slash command to run, as typed by a user, e.g. '/review' or " +
+            "'/git:commit fix the typo'. Leading '/' optional.",
+        },
+      },
+      required: ["command"],
+    },
+    ...TOOL_POLICY_METADATA.slash_command,
+    permissions: {
+      level: "readonly",
+      scopes: ["session:read"],
+    },
+    telemetry: {
+      category: "planning",
+      tags: ["tool:slash_command", "contract:coding-agent", "tier:extension"],
+    },
+  },
   {
     name: "ask_user_question",
     title: "Ask User Question",

package/src/runtime/coding-agent-policy.cjs

@@ -149,6 +149,20 @@ const TOOL_POLICY_METADATA = Object.freeze({
     approvalFlow: "auto",
     isReadOnly: true,
   },
+  // Expand a user-defined slash command (.claude/commands/*.md) into its prompt
+  // text. Read-only by design: the agent path disables `!`cmd`` bang execution,
+  // so only $ARGUMENTS / @file (read) substitution runs — no un-gated shell.
+  // Plan-mode-safe (returns text the model then acts on via its normal tools).
+  slash_command: {
+    riskLevel: RISK_LEVELS.LOW,
+    category: TOOL_CATEGORIES.SKILL,
+    availableInPlanMode: true,
+    planModeBehavior: "allow",
+    requiresPlanApproval: false,
+    requiresConfirmation: false,
+    approvalFlow: "auto",
+    isReadOnly: true,
+  },
   search_sessions: {
     riskLevel: RISK_LEVELS.LOW,
     category: TOOL_CATEGORIES.SEARCH,

package/src/runtime/file-ref-expander.js

@@ -31,6 +31,33 @@ import {
 
 export const DEFAULT_MAX_BYTES = 100 * 1024; // 100 KB per referenced file
 export const DEFAULT_MAX_DIR_ENTRIES = 200;
+// How deep a `@folder/` tree walks (the root's own entries are depth 1).
+export const DEFAULT_MAX_DIR_DEPTH = 3;
+
+// Directory names a `@folder/` tree lists but never DESCENDS into — heavy or
+// noise trees that would burn the whole entry budget (a single `@./` would
+// otherwise spend all 200 entries inside node_modules). They still appear as a
+// node, marked "(not expanded)", so the structure stays honest.
+const TREE_IGNORE_DIRS = new Set([
+  "node_modules",
+  ".git",
+  ".hg",
+  ".svn",
+  "dist",
+  "build",
+  "out",
+  ".next",
+  ".nuxt",
+  ".cache",
+  "coverage",
+  "__pycache__",
+  ".venv",
+  "venv",
+  ".idea",
+  ".gradle",
+  ".turbo",
+  "target",
+]);
 
 // `@` preceded by start / whitespace / opening bracket-quote, then a path run.
 // We capture greedily up to the next whitespace or a closing bracket-quote and
@@ -136,12 +163,58 @@ function readBoundedFile(fs, abs, limit) {
   }
 }
 
+/**
+ * Walk a directory into a bounded, indented tree (Claude-Code `@folder/`
+ * parity — the model sees STRUCTURE, not just the top-level names). Depth- and
+ * entry-capped, and never descends into TREE_IGNORE_DIRS. Symlinks report
+ * isDirectory() === false (Dirent reads the link, not its target), so symlink
+ * loops can never recurse here. Returns { lines, total, truncated } where
+ * `total` is the node count actually emitted (`truncated` means more existed).
+ */
+function buildDirTree(absRoot, { fs, path, maxEntries, maxDepth }) {
+  const lines = [];
+  let count = 0;
+  let truncated = false;
+
+  function walk(abs, depth) {
+    if (truncated) return;
+    let entries;
+    try {
+      entries = fs.readdirSync(abs, { withFileTypes: true });
+    } catch {
+      return; // an unreadable subdir is skipped silently (root errors upstream)
+    }
+    const sorted = entries
+      .map((e) => ({ name: e.name, isDir: e.isDirectory() }))
+      .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    const indent = "  ".repeat(depth - 1);
+    for (const e of sorted) {
+      if (count >= maxEntries) {
+        truncated = true;
+        return;
+      }
+      count++;
+      const ignored = e.isDir && TREE_IGNORE_DIRS.has(e.name);
+      const label = e.isDir ? `${e.name}/` : e.name;
+      lines.push(indent + label + (ignored ? "  (not expanded)" : ""));
+      if (e.isDir && !ignored && depth < maxDepth) {
+        walk(path.resolve(abs, e.name), depth + 1);
+      }
+    }
+  }
+  walk(absRoot, 1);
+  return { lines, total: count, truncated };
+}
+
 /**
  * Resolve a single raw token to an injectable ref descriptor, or null when it
  * does not resolve to an existing path. Tries the literal path first, then a
  * trailing-punctuation-stripped variant (handles "see @config.json.").
  */
-function resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries }) {
+function resolveRef(
+  raw,
+  { cwd, fs, path, maxBytes, maxDirEntries, maxDirDepth },
+) {
   const candidates = [raw];
   const trimmed = trimTrailingPunct(raw);
   if (trimmed && trimmed !== raw) candidates.push(trimmed);
@@ -158,10 +231,12 @@ function resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries }) {
       continue; // not this candidate
     }
     if (stat.isDirectory()) {
-      // A line range on a directory is meaningless — ignore it and list the dir.
-      let entries;
+      // A line range on a directory is meaningless — ignore it and tree the dir.
+      // Probe the root once so an unreadable directory surfaces as a warning
+      // (buildDirTree silently skips unreadable SUBdirs, but the root the user
+      // explicitly pointed at deserves an error).
       try {
-        entries = fs.readdirSync(abs, { withFileTypes: true });
+        fs.readdirSync(abs, { withFileTypes: true });
       } catch (err) {
         return {
           kind: "error",
@@ -170,18 +245,19 @@ function resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries }) {
           message: `cannot read directory: ${err.message}`,
         };
       }
-      const names = entries
-        .slice(0, maxDirEntries)
-        .map((e) => (e.isDirectory() ? `${e.name}/` : e.name))
-        .sort();
-      const truncated = entries.length > maxDirEntries;
+      const tree = buildDirTree(abs, {
+        fs,
+        path,
+        maxEntries: maxDirEntries,
+        maxDepth: maxDirDepth,
+      });
       return {
         kind: "dir",
         raw: cand,
         rel: fsPath,
-        entries: names,
-        total: entries.length,
-        truncated,
+        entries: tree.lines,
+        total: tree.total,
+        truncated: tree.truncated,
       };
     }
     if (stat.isFile()) {
@@ -320,7 +396,7 @@ function renderBlock(refs) {
       parts.push(`<dir ${attrs}>`);
       parts.push(ref.entries.join("\n"));
       if (ref.truncated) {
-        parts.push(`… [truncated — ${ref.total} entries total]`);
+        parts.push(`… [truncated — listing capped at ${ref.total} entries]`);
       }
       parts.push("</dir>");
     } else if (ref.kind === "pdf") {
@@ -385,13 +461,23 @@ function _resolveAllRefs(text, opts) {
   const maxDirEntries = Number.isFinite(opts.maxDirEntries)
     ? opts.maxDirEntries
     : DEFAULT_MAX_DIR_ENTRIES;
+  const maxDirDepth = Number.isFinite(opts.maxDirDepth)
+    ? opts.maxDirDepth
+    : DEFAULT_MAX_DIR_DEPTH;
 
   const tokens = findFileRefTokens(text);
   const refs = [];
   const warnings = [];
 
   for (const { raw } of tokens) {
-    const ref = resolveRef(raw, { cwd, fs, path, maxBytes, maxDirEntries });
+    const ref = resolveRef(raw, {
+      cwd,
+      fs,
+      path,
+      maxBytes,
+      maxDirEntries,
+      maxDirDepth,
+    });
     if (!ref) {
       // Only warn for path-like tokens; bare @mentions are left alone.
       if (looksPathLike(raw)) {

package/src/runtime/headless-runner.js

@@ -280,18 +280,31 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   // an `ask` falls closed (no human to confirm in headless). No file → null →
   // every existing risk-tier / shell-policy layer runs unchanged.
   let permissionRules = options.permissionRules || null;
-  if (!permissionRules) {
-    try {
-      const { loadSettings } = await import("../lib/settings-loader.cjs");
-      const loaded = loadSettings({ cwd, settingsFile: options.settingsFile });
+  let managedSettings = null;
+  try {
+    const { loadSettings, applyManagedPermissionPolicy } =
+      await import("../lib/settings-loader.cjs");
+    const loaded = loadSettings({
+      cwd,
+      settingsFile: options.settingsFile,
+      managedSettingsFile: options.managedSettingsFile,
+    });
+    managedSettings = loaded.managed;
+    if (!permissionRules) {
       const total =
         loaded.rules.allow.length +
         loaded.rules.ask.length +
         loaded.rules.deny.length;
       permissionRules = total > 0 ? loaded.rules : null;
-    } catch {
-      permissionRules = null; // fail-open
+    } else if (managedSettings) {
+      permissionRules = applyManagedPermissionPolicy(
+        permissionRules,
+        managedSettings,
+      );
     }
+  } catch (error) {
+    if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
+    // Preserve caller-provided rules; absent settings keep legacy behavior.
   }
 
   // .claude/settings.json `hooks` block — decision-capable PreToolUse/
@@ -483,6 +496,11 @@ export async function runAgentHeadless(options = {}, deps = {}) {
   }
 
   // ── Permission + tool resolution ──────────────────────────────────────
+  if (managedSettings) {
+    const { assertManagedPermissionMode } =
+      await import("../lib/settings-loader.cjs");
+    assertManagedPermissionMode(options.permissionMode, managedSettings);
+  }
   const perm = resolvePermissionMode(options.permissionMode);
   const enabledToolNames = resolveEnabledTools({
     // An explicit --allowed-tools wins; otherwise a matched command's
@@ -705,6 +723,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
       mcp = await doResolve(
         {
           mcpConfigPath: options.mcpConfig || null,
+          managedSettingsFile: options.managedSettingsFile,
           db: db?.getDatabase?.() || null,
           includeRegistered: options.useRegisteredMcp !== false,
           // --strict-mcp-config: use ONLY the --mcp-config servers, ignoring
@@ -803,6 +822,7 @@ export async function runAgentHeadless(options = {}, deps = {}) {
     apiKey,
     cwd,
     additionalDirectories,
+    sandbox: options.sandbox || null,
     sessionId,
     autoCheckpoint: options.autoCheckpoint || false,
     checkpointSession: options.checkpointSession || sessionId,

package/src/runtime/headless-stream.js

@@ -529,18 +529,31 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
   // .claude/settings.json permission rules (deny > ask > allow); see
   // runAgentHeadless for the full semantics. null = no file → unchanged.
   let permissionRules = options.permissionRules || null;
-  if (!permissionRules) {
-    try {
-      const { loadSettings } = await import("../lib/settings-loader.cjs");
-      const loaded = loadSettings({ cwd, settingsFile: options.settingsFile });
+  let managedSettings = null;
+  try {
+    const { loadSettings, applyManagedPermissionPolicy } =
+      await import("../lib/settings-loader.cjs");
+    const loaded = loadSettings({
+      cwd,
+      settingsFile: options.settingsFile,
+      managedSettingsFile: options.managedSettingsFile,
+    });
+    managedSettings = loaded.managed;
+    if (!permissionRules) {
       const total =
         loaded.rules.allow.length +
         loaded.rules.ask.length +
         loaded.rules.deny.length;
       permissionRules = total > 0 ? loaded.rules : null;
-    } catch {
-      permissionRules = null; // fail-open
+    } else if (managedSettings) {
+      permissionRules = applyManagedPermissionPolicy(
+        permissionRules,
+        managedSettings,
+      );
     }
+  } catch (error) {
+    if (error?.code === "CC_MANAGED_SETTINGS_INVALID") throw error;
+    // Preserve caller-provided rules; absent settings keep legacy behavior.
   }
 
   // .claude/settings.json `hooks` block (decision-capable PreToolUse/PostToolUse).
@@ -617,6 +630,11 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
       return m.getApprovalGate();
     });
 
+  if (managedSettings) {
+    const { assertManagedPermissionMode } =
+      await import("../lib/settings-loader.cjs");
+    assertManagedPermissionMode(options.permissionMode, managedSettings);
+  }
   const perm = resolvePermissionMode(options.permissionMode);
   const enabledToolNames = resolveEnabledTools({
     allowedTools: options.allowedTools,
@@ -910,6 +928,7 @@ export async function runAgentHeadlessStream(options = {}, deps = {}) {
       mcp = await doResolve(
         {
           mcpConfigPath: options.mcpConfig || null,
+          managedSettingsFile: options.managedSettingsFile,
           db: db?.getDatabase?.() || null,
           includeRegistered: options.useRegisteredMcp !== false,
           // --strict-mcp-config: only the --mcp-config servers (ignore

package/src/runtime/mcp-config.js

@@ -60,6 +60,37 @@ export function parseMcpServers(raw) {
   return out;
 }
 
+function managedServerNames(value) {
+  if (!Array.isArray(value)) return null;
+  return new Set(
+    value
+      .map((entry) =>
+        typeof entry === "string" ? entry : entry?.name || entry?.serverName,
+      )
+      .filter(Boolean),
+  );
+}
+
+/** Apply organization MCP allow/deny policy to every server source. */
+export function filterMcpServersByPolicy(servers, policy, writeErr = () => {}) {
+  if (!policy) return servers;
+  const allowed = managedServerNames(policy.allowedMcpServers);
+  const denied = managedServerNames(policy.deniedMcpServers) || new Set();
+  const requireAllowlist =
+    policy.allowManagedMcpServersOnly === true || allowed !== null;
+  const out = {};
+  for (const [name, config] of Object.entries(servers || {})) {
+    const blocked =
+      denied.has(name) || (requireAllowlist && !allowed?.has(name));
+    if (blocked) {
+      writeErr(`  mcp: blocked server "${name}" by managed settings\n`);
+      continue;
+    }
+    out[name] = config;
+  }
+  return out;
+}
+
 /** Namespaced tool name exposed to the LLM. */
 export function mcpToolName(server, tool) {
   return `mcp__${server}__${tool}`;
@@ -119,6 +150,7 @@ export function mcpAuthHint(url, errMessage) {
 export async function setupMcpFromConfig(servers, deps = {}) {
   const writeErr = deps.writeErr || (() => {});
   const createClient = deps.createClient || (() => new MCPClient());
+  servers = filterMcpServersByPolicy(servers, deps.mcpPolicy, writeErr);
 
   // `deps.into` lets a second batch (e.g. registered servers) accumulate into
   // the SAME client + channel objects as a first batch (e.g. --mcp-config), so
@@ -638,8 +670,20 @@ export async function resolveAgentMcp(args = {}, deps = {}) {
   const doJetbrains = deps.loadJetbrainsMcp || loadJetbrainsMcp;
   // Thread the agent session id down to setupMcpFromConfig so spawned stdio MCP
   // servers get CC_SESSION_ID / CLAUDE_CODE_SESSION_ID (Claude-Code parity).
-  const fwd =
-    args.sessionId != null ? { ...deps, sessionId: args.sessionId } : deps;
+  let mcpPolicy = deps.mcpPolicy || null;
+  if (!mcpPolicy) {
+    const { loadManagedSettings } = await import("../lib/settings-loader.cjs");
+    const loaded = loadManagedSettings({
+      env: args.env || process.env,
+      managedSettingsFile: args.managedSettingsFile,
+    });
+    mcpPolicy = loaded.settings;
+  }
+  const fwd = {
+    ...deps,
+    ...(args.sessionId != null ? { sessionId: args.sessionId } : {}),
+    mcpPolicy,
+  };
   let result = null;
   if (args.mcpConfigPath) {
     result = await doFile(args.mcpConfigPath, fwd); // fail-fast on bad file

package/src/runtime/policies/agent-policy.js

@@ -29,6 +29,7 @@ export function resolveAgentPolicy({
     additionalDirectories: Array.isArray(overrides.additionalDirectories)
       ? overrides.additionalDirectories
       : [],
+    sandbox: overrides.sandbox || null,
     autoCheckpoint: overrides.autoCheckpoint === true,
     systemPrompt: overrides.systemPrompt || null,
     appendSystemPrompt: overrides.appendSystemPrompt || null,