chainlesschain 0.162.147 → 0.162.149

package/src/harness/remote-session-registry.js

@@ -0,0 +1,420 @@
+import { createHash, randomBytes, randomUUID, timingSafeEqual } from "crypto";
+
+export const REMOTE_SESSION_PROTOCOL_VERSION = "1.0";
+export const REMOTE_SESSION_SCOPES = Object.freeze([
+  "observe",
+  "prompt",
+  "approve",
+  "interrupt",
+]);
+
+const DEFAULT_TOKEN_TTL_MS = 5 * 60 * 1000;
+const DEFAULT_SESSION_TTL_MS = 12 * 60 * 60 * 1000;
+
+function hashToken(token) {
+  return createHash("sha256").update(String(token), "utf8").digest();
+}
+
+function tokensMatch(token, digest) {
+  const candidate = hashToken(token);
+  return (
+    candidate.length === digest.length && timingSafeEqual(candidate, digest)
+  );
+}
+
+function normalizeScopes(scopes) {
+  const requested = scopes || REMOTE_SESSION_SCOPES;
+  if (!Array.isArray(requested) || requested.length === 0) {
+    throw new TypeError("Remote session scopes must be a non-empty array");
+  }
+  const unique = [...new Set(requested)];
+  for (const scope of unique) {
+    if (!REMOTE_SESSION_SCOPES.includes(scope)) {
+      throw new Error(`Unsupported remote session scope: ${scope}`);
+    }
+  }
+  return unique;
+}
+
+/**
+ * Org-level constraints an administrator can impose on Remote Sessions. Lives
+ * next to the registry (its single enforcement point) so both the direct WS
+ * join and the relay pairing path go through the same checks. Permissive by
+ * default — an unconfigured policy is a no-op.
+ */
+export class RemoteSessionPolicy {
+  constructor({
+    allowedScopes = null,
+    maxDevices = null,
+    maxSessionTtlMs = null,
+    maxTokenTtlMs = null,
+    allowRelayPairing = true,
+  } = {}) {
+    this.allowedScopes = allowedScopes ? [...new Set(allowedScopes)] : null;
+    if (this.allowedScopes) {
+      if (this.allowedScopes.length === 0) {
+        throw new Error("allowedScopes cannot be empty");
+      }
+      for (const scope of this.allowedScopes) {
+        if (!REMOTE_SESSION_SCOPES.includes(scope)) {
+          throw new Error(`Unknown scope in org policy: ${scope}`);
+        }
+      }
+    }
+    this.maxDevices =
+      maxDevices == null ? null : Math.max(0, Math.floor(maxDevices));
+    this.maxSessionTtlMs =
+      maxSessionTtlMs == null ? null : Math.max(1, Math.floor(maxSessionTtlMs));
+    this.maxTokenTtlMs =
+      maxTokenTtlMs == null ? null : Math.max(1, Math.floor(maxTokenTtlMs));
+    this.allowRelayPairing = allowRelayPairing !== false;
+  }
+
+  /**
+   * Narrow requested scopes to the org-allowed set. Throws only when the request
+   * and the allow-list are wholly disjoint (i.e. nothing could be granted).
+   */
+  applyScopes(requestedScopes) {
+    if (!this.allowedScopes) {
+      return { scopes: requestedScopes || null, narrowed: false };
+    }
+    const requested =
+      requestedScopes && requestedScopes.length
+        ? [...new Set(requestedScopes)]
+        : [...REMOTE_SESSION_SCOPES];
+    const granted = requested.filter((scope) =>
+      this.allowedScopes.includes(scope),
+    );
+    if (granted.length === 0) {
+      throw new Error("Remote session scopes are not permitted by org policy");
+    }
+    return { scopes: granted, narrowed: granted.length !== requested.length };
+  }
+
+  capSessionTtl(ttlMs) {
+    return this.maxSessionTtlMs == null
+      ? ttlMs
+      : Math.min(ttlMs, this.maxSessionTtlMs);
+  }
+
+  capTokenTtl(ttlMs) {
+    return this.maxTokenTtlMs == null
+      ? ttlMs
+      : Math.min(ttlMs, this.maxTokenTtlMs);
+  }
+
+  enforceJoin({ deviceCount, via } = {}) {
+    if (via === "relay" && !this.allowRelayPairing) {
+      throw new Error("Relay pairing is disabled by org policy");
+    }
+    if (this.maxDevices != null && deviceCount >= this.maxDevices) {
+      throw new Error("Org policy device limit reached");
+    }
+  }
+
+  describe() {
+    return {
+      allowedScopes: this.allowedScopes,
+      maxDevices: this.maxDevices,
+      maxSessionTtlMs: this.maxSessionTtlMs,
+      maxTokenTtlMs: this.maxTokenTtlMs,
+      allowRelayPairing: this.allowRelayPairing,
+    };
+  }
+
+  static fromEnv(env = {}) {
+    const options = {};
+    const scopes = env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOWED_SCOPES;
+    if (scopes) {
+      options.allowedScopes = scopes
+        .split(",")
+        .map((scope) => scope.trim())
+        .filter(Boolean);
+    }
+    const num = (value) => {
+      const parsed = Number(value);
+      return Number.isFinite(parsed) ? parsed : null;
+    };
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_DEVICES != null) {
+      options.maxDevices = num(env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_DEVICES);
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_SESSION_TTL_MS != null) {
+      options.maxSessionTtlMs = num(
+        env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_SESSION_TTL_MS,
+      );
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_TOKEN_TTL_MS != null) {
+      options.maxTokenTtlMs = num(
+        env.CHAINLESSCHAIN_REMOTE_SESSION_MAX_TOKEN_TTL_MS,
+      );
+    }
+    if (env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOW_RELAY != null) {
+      options.allowRelayPairing = !/^(0|false|no|off)$/i.test(
+        String(env.CHAINLESSCHAIN_REMOTE_SESSION_ALLOW_RELAY).trim(),
+      );
+    }
+    return new RemoteSessionPolicy(options);
+  }
+}
+
+function publicSession(session) {
+  return {
+    protocolVersion: REMOTE_SESSION_PROTOCOL_VERSION,
+    sessionId: session.sessionId,
+    agentSessionId: session.agentSessionId,
+    name: session.name,
+    hostClientId: session.hostClientId,
+    createdAt: session.createdAt,
+    expiresAt: session.expiresAt,
+    memberCount: session.members.size,
+  };
+}
+
+/** In-memory authorization state for one local CLI process. */
+export class RemoteSessionRegistry {
+  constructor(options = {}) {
+    this.now = options.now || Date.now;
+    this.tokenTtlMs = options.tokenTtlMs || DEFAULT_TOKEN_TTL_MS;
+    this.sessionTtlMs = options.sessionTtlMs || DEFAULT_SESSION_TTL_MS;
+    this.policy = options.policy || new RemoteSessionPolicy();
+    this.sessions = new Map();
+    this.tokens = new Map();
+  }
+
+  create({ hostClientId, agentSessionId, name, scopes } = {}) {
+    if (!hostClientId) throw new Error("hostClientId is required");
+    if (!agentSessionId) throw new Error("agentSessionId is required");
+    const now = this.now();
+    const session = {
+      sessionId: randomUUID(),
+      agentSessionId,
+      name: name || agentSessionId,
+      hostClientId,
+      createdAt: now,
+      expiresAt: now + this.policy.capSessionTtl(this.sessionTtlMs),
+      members: new Map([
+        [
+          hostClientId,
+          {
+            clientId: hostClientId,
+            scopes: REMOTE_SESSION_SCOPES,
+            joinedAt: now,
+          },
+        ],
+      ]),
+    };
+    this.sessions.set(session.sessionId, session);
+    return {
+      session: publicSession(session),
+      pairing: this.issuePairingToken(session.sessionId, { scopes }),
+    };
+  }
+
+  issuePairingToken(sessionId, { scopes } = {}) {
+    const session = this.requireSession(sessionId);
+    const token = randomBytes(32).toString("base64url");
+    const now = this.now();
+    const { scopes: applied, narrowed } = this.policy.applyScopes(scopes);
+    const grantedScopes = normalizeScopes(applied);
+    this.tokens.set(sessionId, {
+      digest: hashToken(token),
+      scopes: grantedScopes,
+      createdAt: now,
+      expiresAt: Math.min(
+        now + this.policy.capTokenTtl(this.tokenTtlMs),
+        session.expiresAt,
+      ),
+    });
+    return {
+      token,
+      expiresAt: this.tokens.get(sessionId).expiresAt,
+      scopes: grantedScopes,
+      policyNarrowed: narrowed,
+    };
+  }
+
+  join({
+    sessionId,
+    clientId,
+    token,
+    via = "direct",
+    pushToken = null,
+    pushProvider = null,
+  } = {}) {
+    if (!clientId) throw new Error("clientId is required");
+    const session = this.requireSession(sessionId);
+    const pairing = this.tokens.get(sessionId);
+    if (!pairing || pairing.expiresAt <= this.now()) {
+      this.tokens.delete(sessionId);
+      throw new Error("Pairing token is missing or expired");
+    }
+    if (!tokensMatch(token, pairing.digest)) {
+      throw new Error("Invalid pairing token");
+    }
+    // Org policy is enforced only after the token proves the caller is invited,
+    // so a device-limit / relay-disabled message never leaks to unauthenticated
+    // probes. Existing (non-host) devices count against the limit.
+    const deviceCount = [...session.members.values()].filter(
+      (member) => member.clientId !== session.hostClientId,
+    ).length;
+    this.policy.enforceJoin({ deviceCount, via });
+    // Pairing credentials are deliberately one-time. The host must explicitly
+    // issue another token for each additional device.
+    this.tokens.delete(sessionId);
+    const member = {
+      clientId,
+      scopes: pairing.scopes,
+      joinedAt: this.now(),
+      pushToken: pushToken || null,
+      pushProvider: pushToken ? pushProvider || null : null,
+    };
+    session.members.set(clientId, member);
+    return { session: publicSession(session), member: { ...member } };
+  }
+
+  /**
+   * A device registers (or refreshes / clears) its own vendor push token after
+   * pairing — e.g. once FCM assigns one. Only an existing member may set its own
+   * token. A null token clears push for that device.
+   */
+  registerPush(sessionId, clientId, { token = null, provider = null } = {}) {
+    const session = this.requireSession(sessionId);
+    const member = session.members.get(clientId);
+    if (!member) {
+      throw new Error("Device is not paired with this remote session");
+    }
+    member.pushToken = token || null;
+    member.pushProvider = token ? provider || null : null;
+    return {
+      clientId,
+      hasPush: Boolean(member.pushToken),
+      provider: member.pushProvider,
+    };
+  }
+
+  /** Non-host members that carry a push token, for wake-up dispatch. */
+  pushTargets(sessionId, { excludeClientId } = {}) {
+    const session = this.requireSession(sessionId);
+    const targets = [];
+    for (const member of session.members.values()) {
+      if (member.clientId === session.hostClientId) continue;
+      if (member.clientId === excludeClientId) continue;
+      if (!member.pushToken) continue;
+      targets.push({
+        clientId: member.clientId,
+        pushToken: member.pushToken,
+        pushProvider: member.pushProvider,
+      });
+    }
+    return targets;
+  }
+
+  authorize(sessionId, clientId, scope) {
+    const session = this.requireSession(sessionId);
+    const member = session.members.get(clientId);
+    if (!member)
+      throw new Error("Client is not paired with this remote session");
+    if (!member.scopes.includes(scope)) {
+      throw new Error(`Remote session scope required: ${scope}`);
+    }
+    return { session, member };
+  }
+
+  members(sessionId) {
+    const session = this.requireSession(sessionId);
+    return [...session.members.values()].map((member) => ({ ...member }));
+  }
+
+  /**
+   * Host-only view of every paired device on a session. The host flag lets the
+   * UI keep the host row un-revocable and label it distinctly.
+   */
+  listDevices(sessionId, hostClientId) {
+    const session = this.requireSession(sessionId);
+    if (hostClientId && session.hostClientId !== hostClientId) {
+      throw new Error("Only the host can list paired devices");
+    }
+    return {
+      session: publicSession(session),
+      devices: [...session.members.values()].map((member) => ({
+        clientId: member.clientId,
+        scopes: [...member.scopes],
+        joinedAt: member.joinedAt,
+        isHost: member.clientId === session.hostClientId,
+        hasPush: Boolean(member.pushToken),
+        pushProvider: member.pushProvider || null,
+      })),
+    };
+  }
+
+  /**
+   * Host-initiated revocation of a single paired device. The host cannot revoke
+   * itself (use close() to end the whole session). Returns the removed member so
+   * callers can push a revocation notice to that device.
+   */
+  revokeMember(sessionId, hostClientId, clientId) {
+    if (!clientId) throw new Error("clientId is required");
+    const session = this.requireSession(sessionId);
+    if (session.hostClientId !== hostClientId) {
+      throw new Error("Only the host can revoke devices");
+    }
+    if (clientId === session.hostClientId) {
+      throw new Error("Cannot revoke the host device");
+    }
+    const member = session.members.get(clientId);
+    if (!member)
+      throw new Error("Device is not paired with this remote session");
+    session.members.delete(clientId);
+    return { session: publicSession(session), member: { ...member } };
+  }
+
+  findHosted(agentSessionId, hostClientId) {
+    const matches = [];
+    for (const session of this.sessions.values()) {
+      if (
+        session.agentSessionId === agentSessionId &&
+        session.hostClientId === hostClientId &&
+        session.expiresAt > this.now()
+      ) {
+        matches.push(session);
+      }
+    }
+    return matches;
+  }
+
+  removeClient(clientId) {
+    const affected = [];
+    for (const [sessionId, session] of this.sessions) {
+      if (!session.members.delete(clientId)) continue;
+      if (session.hostClientId === clientId) {
+        this.sessions.delete(sessionId);
+        this.tokens.delete(sessionId);
+        affected.push({ sessionId, closed: true });
+      } else {
+        affected.push({ sessionId, closed: false });
+      }
+    }
+    return affected;
+  }
+
+  close(sessionId, clientId) {
+    const session = this.requireSession(sessionId);
+    if (session.hostClientId !== clientId) {
+      throw new Error("Only the host can close a Remote Session");
+    }
+    this.sessions.delete(sessionId);
+    this.tokens.delete(sessionId);
+    return publicSession(session);
+  }
+
+  requireSession(sessionId) {
+    const session = this.sessions.get(sessionId);
+    if (!session) throw new Error("Remote session not found");
+    if (session.expiresAt <= this.now()) {
+      this.sessions.delete(sessionId);
+      this.tokens.delete(sessionId);
+      throw new Error("Remote session expired");
+    }
+    return session;
+  }
+}

package/src/index.js

@@ -17,6 +17,8 @@ import { registerAskCommand } from "./commands/ask.js";
 import { registerLlmCommand } from "./commands/llm.js";
 import { registerHubCommand } from "./commands/hub.js";
 import { registerAndroidCommand } from "./commands/android.js";
+import { registerEvalCommand } from "./commands/eval.js";
+import { registerTeamCommand } from "./commands/team.js";
 import {
   registerAgentCommand,
   registerSubAgentV2Command,
@@ -58,6 +60,7 @@ import { registerRCacheCommand } from "./commands/rcache.js";
 import { registerSessionCommand } from "./commands/session.js";
 import { registerCostCommand } from "./commands/cost.js";
 import { registerContextCommand } from "./commands/context.js";
+import { registerCodeIntelCommand } from "./commands/codeintel.js";
 import { registerCheckpointCommand } from "./commands/checkpoint.js";
 import { registerGoalCommand } from "./commands/goal.js";
 import { registerCommandCommand } from "./commands/command.js";
@@ -428,6 +431,8 @@ export function createProgram(opts = {}) {
   registerHubCommand(program);
   registerAndroidCommand(program);
   registerAgentCommand(program);
+  registerEvalCommand(program);
+  registerTeamCommand(program);
   registerSubAgentV2Command(program);
   registerExecBackendV2Command(program);
   registerTodoV2Command(program);
@@ -468,6 +473,7 @@ export function createProgram(opts = {}) {
   registerSessionCommand(program);
   registerCostCommand(program);
   registerContextCommand(program);
+  registerCodeIntelCommand(program);
   registerCheckpointCommand(program);
   registerGoalCommand(program);
   registerCommandCommand(program);

package/src/lib/agent-core.js

@@ -42,4 +42,6 @@ export {
   _toAnthropicMessages,
   _anthropicThinkingParams,
   _normalizeAnthropicResponse,
+  _resetFileFreshness,
+  disposeSharedCodeIntel,
 } from "../runtime/agent-core.js";

package/src/lib/agent-sandbox.js

@@ -1,29 +1,107 @@
 /** OS-isolated shell execution for the coding agent. */
 import { spawnSync } from "node:child_process";
 import path from "node:path";
+import { proxyEnv } from "./sandbox-egress-proxy.js";
 
 export const DEFAULT_SANDBOX_IMAGE = "node:22-bookworm-slim";
 export const _deps = { spawnSync };
 
+function stringList(value) {
+  if (!Array.isArray(value)) return [];
+  return [
+    ...new Set(
+      value.map((entry) => String(entry || "").trim()).filter(Boolean),
+    ),
+  ];
+}
+
+function resolvePolicyPaths(entries, cwd) {
+  return stringList(entries).map((entry) => {
+    if (entry.startsWith("~/")) {
+      return path.resolve(
+        process.env.HOME || process.env.USERPROFILE || "",
+        entry.slice(2),
+      );
+    }
+    return path.resolve(cwd, entry);
+  });
+}
+
+export function normalizeSandboxPolicy(settings = {}, cwd = process.cwd()) {
+  const filesystem = settings.filesystem || {};
+  const network = settings.network || {};
+  return {
+    allowRead: resolvePolicyPaths(filesystem.allowRead, cwd),
+    denyRead: resolvePolicyPaths(filesystem.denyRead, cwd),
+    allowWrite: resolvePolicyPaths(filesystem.allowWrite, cwd),
+    denyWrite: resolvePolicyPaths(filesystem.denyWrite, cwd),
+    allowedDomains: stringList(network.allowedDomains),
+    deniedDomains: stringList(network.deniedDomains),
+    excludedCommands: stringList(settings.excludedCommands),
+    allowUnsandboxedCommands: settings.allowUnsandboxedCommands !== false,
+    failIfUnavailable: settings.failIfUnavailable === true,
+  };
+}
+
 export function normalizeAgentSandbox(value, options = {}) {
-  if (!value) return null;
+  const settings = options.settings || {};
+  if (!value && settings.enabled !== true) return null;
+  if (value === false || settings.enabled === false) return null;
   const image =
     typeof value === "string" && value.trim() && value !== "true"
       ? value.trim()
       : DEFAULT_SANDBOX_IMAGE;
   return {
-    engine: "docker",
-    image,
+    engine: settings.engine || "docker",
+    image: settings.image || image,
     cwd: path.resolve(options.cwd || process.cwd()),
-    network: options.network === true,
+    network: options.network === true || settings.network === true,
+    policy: normalizeSandboxPolicy(settings, options.cwd || process.cwd()),
   };
 }
 
 export function executeSandboxedShell(command, sandbox, options = {}) {
-  if (!sandbox || sandbox.engine !== "docker") {
+  if (!sandbox || !["docker", "bubblewrap"].includes(sandbox.engine)) {
     throw new Error("A supported agent sandbox configuration is required");
   }
   const hostCwd = path.resolve(options.cwd || sandbox.cwd);
+  const policy = sandbox.policy || normalizeSandboxPolicy({}, hostCwd);
+  // An egress proxy (see sandbox-egress-proxy.js) ENFORCES the domain allow/deny
+  // policy: the caller starts it and passes `{ env }` here, and the sandboxed
+  // process routes its HTTP(S) traffic through it. Without a proxy, a
+  // domain-restricted network request has no enforcement point, so we refuse
+  // rather than grant unrestricted access.
+  const egress = options.egressProxy || null;
+  if (
+    (policy.allowedDomains.length || policy.deniedDomains.length) &&
+    sandbox.network &&
+    !egress
+  ) {
+    return {
+      stdout: "",
+      stderr:
+        "Domain-restricted sandbox networking requires a configured sandbox proxy; refusing unrestricted network access",
+      exitCode: 1,
+      failedToStart: true,
+    };
+  }
+  if (sandbox.engine === "bubblewrap") {
+    return executeBubblewrapShell(command, sandbox, options, hostCwd, policy);
+  }
+  if (
+    policy.allowRead.length ||
+    policy.denyRead.length ||
+    policy.allowWrite.length ||
+    policy.denyWrite.length
+  ) {
+    return {
+      stdout: "",
+      stderr:
+        "The Docker sandbox backend cannot enforce fine-grained filesystem policy; use engine=bubblewrap",
+      exitCode: 1,
+      failedToStart: true,
+    };
+  }
   const args = ["run", "--rm", "--init"];
   if (!sandbox.network) args.push("--network", "none");
   args.push("--mount", `type=bind,source=${hostCwd},target=/workspace`);
@@ -31,6 +109,17 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   if (process.platform !== "win32" && process.getuid && process.getgid) {
     args.push("--user", `${process.getuid()}:${process.getgid()}`);
   }
+  // Route egress through the host proxy so the domain policy is enforced. The
+  // container reaches the host proxy via host.docker.internal (mapped to the
+  // gateway on Linux via host-gateway); the caller builds `egress.env` with that
+  // hostname (proxyEnv(port, "host.docker.internal")).
+  if (egress && egress.port && sandbox.network) {
+    args.push("--add-host", "host.docker.internal:host-gateway");
+    const penv = proxyEnv(egress.port, "host.docker.internal");
+    for (const [k, v] of Object.entries(penv)) {
+      args.push("--env", `${k}=${v}`);
+    }
+  }
   const env = options.env || {};
   for (const key of ["CLAUDECODE", "CC_SESSION_ID", "CLAUDE_CODE_SESSION_ID"]) {
     if (env[key] != null) args.push("--env", `${key}=${env[key]}`);
@@ -61,6 +150,65 @@ export function executeSandboxedShell(command, sandbox, options = {}) {
   };
 }
 
+function executeBubblewrapShell(command, sandbox, options, hostCwd, policy) {
+  const args = [
+    "--die-with-parent",
+    "--new-session",
+    "--unshare-all",
+    "--ro-bind",
+    "/",
+    "/",
+    "--bind",
+    hostCwd,
+    hostCwd,
+    "--chdir",
+    hostCwd,
+    "--proc",
+    "/proc",
+    "--dev",
+    "/dev",
+    "--tmpfs",
+    "/tmp",
+  ];
+  if (sandbox.network) args.push("--share-net");
+  for (const target of policy.allowWrite) args.push("--bind", target, target);
+  for (const target of policy.denyWrite) args.push("--ro-bind", target, target);
+  for (const target of policy.denyRead) args.push("--tmpfs", target);
+  args.push("--", "sh", "-lc", String(command || ""));
+  // bwrap `--share-net` shares the host network namespace, so the egress proxy
+  // is reachable at 127.0.0.1 directly — merge its env into the child's.
+  const egress = options.egressProxy || null;
+  const bwrapEnv =
+    egress && egress.port && sandbox.network
+      ? { ...(options.env || {}), ...proxyEnv(egress.port, "127.0.0.1") }
+      : options.env;
+  const result = _deps.spawnSync("bwrap", args, {
+    cwd: hostCwd,
+    env: bwrapEnv,
+    encoding: "utf8",
+    timeout: options.timeout,
+    maxBuffer: options.maxBuffer,
+    windowsHide: true,
+  });
+  if (result.error) {
+    return {
+      stdout: result.stdout || "",
+      stderr:
+        result.error.code === "ENOENT"
+          ? "bubblewrap is not installed"
+          : result.error.message,
+      exitCode: typeof result.status === "number" ? result.status : 1,
+      failedToStart: true,
+    };
+  }
+  return {
+    stdout: result.stdout || "",
+    stderr: result.stderr || "",
+    exitCode: typeof result.status === "number" ? result.status : 1,
+    signal: result.signal || null,
+  };
+}
+
 export function sandboxSummary(sandbox) {
   if (!sandbox) return null;
   return {
@@ -68,5 +216,13 @@ export function sandboxSummary(sandbox) {
     image: sandbox.image,
     network: sandbox.network ? "enabled" : "disabled",
     workspace: "read-write",
+    policy: {
+      additionalReadPaths: sandbox.policy?.allowRead?.length || 0,
+      additionalWritePaths: sandbox.policy?.allowWrite?.length || 0,
+      networkRestricted:
+        Boolean(sandbox.policy?.allowedDomains?.length) ||
+        Boolean(sandbox.policy?.deniedDomains?.length),
+      failIfUnavailable: sandbox.policy?.failIfUnavailable === true,
+    },
   };
 }