chainlesschain 0.162.180 → 0.162.182

package/src/commands/context.js

@@ -330,14 +330,81 @@ export function registerContextCommand(program) {
           );
         }
         if (sourceReport.skillCache.descriptors.resident > 0) {
+          const skillDescriptors = sourceReport.skillCache.descriptors;
+          const skillBodies = sourceReport.skillCache.bodies;
           logger.log("");
           logger.log(
             chalk.gray(
-              `  Skill cache: ${sourceReport.skillCache.descriptors.resident} descriptors, ` +
-                `${sourceReport.skillCache.bodies.resident} bodies resident, ` +
+              `  Skill cache: ${skillDescriptors.resident} descriptors ` +
+                `(${skillDescriptors.estimatedTokens} estimated descriptor-token equivalents), ` +
+                `${skillBodies.resident} bodies resident ` +
+                `(${skillBodies.estimatedTokensResident} estimated body-token equivalents), ` +
                 `${sourceReport.skillCache.savings.estimatedTokensAvoided} estimated tokens kept lazy`,
             ),
           );
+          logger.log(
+            chalk.gray(
+              `  Descriptor prompt returns: ${skillDescriptors.contextLoads} / ` +
+                `${skillDescriptors.contextTokens} estimated context tokens`,
+            ),
+          );
+          logger.log(
+            chalk.gray(
+              `  On-demand reads: ${skillBodies.cacheMisses} disk / ` +
+                `${skillBodies.cacheHits} cache; cache reuse avoided ` +
+                `${skillBodies.estimatedTokensAvoidedByCache} body-token equivalents of disk reads`,
+            ),
+          );
+          logger.log(
+            chalk.gray(
+              `  Prompt injections: ${skillBodies.contextLoads} loads / ` +
+                `${skillBodies.contextTokens} estimated context tokens`,
+            ),
+          );
+          const activeBodies = [...skillBodies.entries]
+            .filter((entry) => entry.loads > 0 || entry.contextLoads > 0)
+            .sort(
+              (a, b) =>
+                b.contextTokens - a.contextTokens ||
+                b.loads - a.loads ||
+                a.id.localeCompare(b.id),
+            );
+          for (const entry of activeBodies.slice(0, 8)) {
+            logger.log(
+              chalk.gray(
+                `    ${entry.id} [${entry.source}]: ${entry.estimatedTokens} token body; ` +
+                  `${entry.cacheMisses} disk / ${entry.cacheHits} cache reads; ` +
+                  `${entry.contextLoads} prompt loads / ${entry.contextTokens} tokens`,
+              ),
+            );
+          }
+          if (activeBodies.length > 8) {
+            logger.log(
+              chalk.gray(`    ... ${activeBodies.length - 8} more active bodies`),
+            );
+          }
+          const usedDescriptors = [...skillDescriptors.entries]
+            .filter((entry) => entry.contextLoads > 0)
+            .sort(
+              (a, b) =>
+                b.contextTokens - a.contextTokens ||
+                a.id.localeCompare(b.id),
+            );
+          for (const entry of usedDescriptors.slice(0, 8)) {
+            logger.log(
+              chalk.gray(
+                `    descriptor ${entry.id} [${entry.source}]: ` +
+                  `${entry.contextLoads} prompt returns / ${entry.contextTokens} tokens`,
+              ),
+            );
+          }
+          if (usedDescriptors.length > 8) {
+            logger.log(
+              chalk.gray(
+                `    ... ${usedDescriptors.length - 8} more used descriptors`,
+              ),
+            );
+          }
         }
         if (sourceReport.optimizations.length > 0) {
           logger.log("");

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.182",
+      "cliVersions": ["0.162.181", "0.162.182"],
+      "date": "2026-07-27",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.182: attested native plugin sandbox closure",
+          "body": "> `chainlesschain` **0.162.181 → 0.162.182** (2026-07-27).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **One-shot native plugin execution contracts**: policy-bearing native plugin\n  bins must preserve the resolver-issued target, literal argv, plugin root, and\n  executable identity through the process broker. Replayed, copied, stale, or\n  asynchronous contracts fail closed before a target process is started.\n- **Linux strong boundary completion**: strict native launches accept only\n  attested static ELF executables for the current architecture, reject dynamic\n  loaders and malformed program headers, pin the plugin tree through file\n  descriptors, and enter the fixed bubblewrap filesystem/network policy\n  without exposing a mutable host path.\n- **Cross-platform identity hardening**: Windows AppContainer launches retain\n  attested target handles, while platform adapters revalidate executable and\n  plugin identities across probe, spawn, IPC, and detached launch boundaries.\n- **Release validation gate**: the exact release commit must pass `CLI CI` and\n  `CLI Strict Sandbox` on their configured Ubuntu, Windows, and macOS runners;\n  local tests are supplementary and cannot authorize publication."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.181",
+      "cliVersions": ["0.162.181"],
+      "date": "2026-07-26",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.181 + PDH 0.4.57 + Agent SDK 0.1.7: sandbox contracts and complete collection",
+          "body": "> `chainlesschain` **0.162.181** bundles\n> `@chainlesschain/personal-data-hub` **0.4.57** and co-releases\n> `@chainlesschain/agent-sdk` **0.1.7** (2026-07-26).\n\n- **Enforced process boundaries**: the CLI process broker preserves native\n  sandbox identity across foreground, detached, IPC, plugin hook, MCP, monitor,\n  and LSP launches. Plugin manifests can require explicit sandbox boundaries,\n  and Linux launches attest the primitives actually applied.\n- **Runtime and protocol convergence**: restore compatibility-shim exports,\n  keep permission-decision fields stable in golden transcripts, and carry the\n  current background-session and event-recovery contract through the Agent SDK.\n- **Complete resumable collection**: PDH adapters use explicit cursors and\n  bounded page budgets across local databases, desktop clients, mobile APIs,\n  maps, social, messaging, education, music, health, shopping, and travel\n  sources. Partial or unreadable SQLite results now fail closed instead of\n  silently advancing checkpoints.\n- **Release validation**: PDH 282 files / 4,528 tests, Agent SDK build plus\n  50 tests, CLI sandbox/plugin focused regression, Web Panel build, and\n  isolated Git-worktree/WebSocket regressions passed before publication."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.162.180",

package/src/gateways/terminal/PtyManager.js

@@ -1,9 +1,9 @@
 /**
  * PtyManager — ESM mirror of `desktop-app-vue/src/main/terminal/PtyManager.js`.
  *
- * Keep both copies in sync. The desktop copy targets Electron's CJS main
- * process; this one targets `cc ui` (Node ESM) so `cc ui` users also get
- * remote-terminal support via the same WS protocol.
+ * Keep their protocol and session behavior in sync. The desktop copy targets
+ * Electron's CJS main process; this one targets `cc ui` (Node ESM), whose host
+ * injects its own trusted workspace-policy resolver.
  *
  * Design notes — see docs/design/Android_Remote_Terminal_Plan_A.md §4:
  *   - node-pty loaded lazily so the module loads without the native
@@ -44,6 +44,24 @@ function resolveShellCmd(shell) {
   return shell;
 }
 
+function validatePinnedSandboxPolicy(policy) {
+  if (policy == null) return null;
+  if (
+    typeof policy !== "object" ||
+    Array.isArray(policy) ||
+    typeof policy.then === "function" ||
+    !Array.isArray(policy.requiredBoundaries) ||
+    policy.requiredBoundaries.length === 0 ||
+    !Object.isFrozen(policy) ||
+    !Object.isFrozen(policy.requiredBoundaries)
+  ) {
+    const error = new TypeError("invalid_pty_sandbox_policy");
+    error.code = "ERR_PTY_SANDBOX_POLICY_INVALID";
+    throw error;
+  }
+  return policy;
+}
+
 class PtySession {
   constructor({ id, shell, cwd, cols, rows, proc, createdAt, ringBuffer }) {
     this.id = id;
@@ -65,6 +83,16 @@ export class PtyManager extends EventEmitter {
   constructor(opts = {}) {
     super();
     this.config = { ...DEFAULT_CONFIG, ...(opts.config || {}) };
+    const resolveSandboxPolicy =
+      opts.resolveSandboxPolicy ?? opts._deps?.resolveSandboxPolicy ?? null;
+    if (
+      resolveSandboxPolicy !== null &&
+      typeof resolveSandboxPolicy !== "function"
+    ) {
+      throw new TypeError("resolveSandboxPolicy must be a function or null");
+    }
+    this._policyCwd = opts.policyCwd || process.cwd();
+    this._resolveSandboxPolicy = resolveSandboxPolicy;
     this._deps = {
       loadNodePty: opts._deps?.loadNodePty || (() => require("node-pty")),
       spawnPty: opts._deps?.spawnPty || null,
@@ -92,6 +120,19 @@ export class PtyManager extends EventEmitter {
       throw new Error("shell_not_allowed");
     }
 
+    const cwd = req.cwd || this.config.defaultCwd || process.cwd();
+    // A remote cwd may discover a stricter policy, but it must never replace
+    // the fixed workspace root supplied by the host. Resolve and validate the
+    // pinned policy before loading node-pty or allocating a native terminal.
+    const sandboxPolicy = this._resolveSandboxPolicy
+      ? validatePinnedSandboxPolicy(
+          this._resolveSandboxPolicy({
+            workspaceCwd: this._policyCwd,
+            executionCwd: cwd,
+          }),
+        )
+      : null;
+
     let pty;
     try {
       pty = this._deps.loadNodePty();
@@ -101,7 +142,6 @@ export class PtyManager extends EventEmitter {
       throw err;
     }
 
-    const cwd = req.cwd || this.config.defaultCwd || process.cwd();
     const cols = Number.isFinite(req.cols) ? req.cols : 80;
     const rows = Number.isFinite(req.rows) ? req.rows : 24;
     const cmd = resolveShellCmd(shell);
@@ -123,6 +163,7 @@ export class PtyManager extends EventEmitter {
       origin: "terminal:pty",
       policy: "allow",
       scope: "terminal",
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
     });
 
     const sessionId = randomUUID();

package/src/gateways/ws/background-agent-protocol.js

@@ -12,6 +12,8 @@
  *                                    log, latestSeq, [reattached, replayed,
  *                                    replayTruncated]}
  *   bg-prompt    {bgId, text}      → {type:"bg-prompt", bgId, sent}
+ *   bg-answer    {bgId, requestId, binding, answer}
+ *                                  → {type:"bg-answer", bgId, sent}
  *   bg-stop-turn {bgId}            → {type:"bg-stop-turn", bgId, sent}
  *   bg-detach    {bgId}            → {type:"bg-detach", bgId}
  *   bg-stop      {bgId}            → {type:"bg-stop", session}   (kill whole session)
@@ -340,6 +342,42 @@ export async function handleBgPrompt(server, clientId, id, ws, message) {
   server._send(ws, { id, type: "bg-prompt", bgId: message.bgId, sent });
 }
 
+export async function handleBgAnswer(server, clientId, id, ws, message) {
+  const entry = requireAttachment(server, clientId, id, ws, message);
+  if (!entry) return;
+  const requestId = String(message.requestId || "");
+  if (!requestId) {
+    return sendError(server, id, ws, "NO_REQUEST_ID", "requestId required");
+  }
+  if (
+    !message.binding ||
+    typeof message.binding !== "object" ||
+    Array.isArray(message.binding)
+  ) {
+    return sendError(
+      server,
+      id,
+      ws,
+      "NO_INTERACTION_BINDING",
+      "interaction binding required",
+    );
+  }
+  const sent = entry.conn.send({
+    type: "interaction_response",
+    requestId,
+    binding: message.binding,
+    answer: message.answer,
+    ...(message.error ? { error: message.error } : {}),
+  });
+  server._send(ws, {
+    id,
+    type: "bg-answer",
+    bgId: message.bgId,
+    requestId,
+    sent,
+  });
+}
+
 export async function handleBgStopTurn(server, clientId, id, ws, message) {
   const entry = requireAttachment(server, clientId, id, ws, message);
   if (!entry) return;

package/src/gateways/ws/message-dispatcher.js

@@ -182,6 +182,7 @@ export function createWsMessageDispatcher(server) {
         "bg-view": () => server._handleBgView(id, ws, message),
         "bg-attach": () => server._handleBgAttach(clientId, id, ws, message),
         "bg-prompt": () => server._handleBgPrompt(clientId, id, ws, message),
+        "bg-answer": () => server._handleBgAnswer(clientId, id, ws, message),
         "bg-stop-turn": () =>
           server._handleBgStopTurn(clientId, id, ws, message),
         "bg-detach": () => server._handleBgDetach(clientId, id, ws, message),

package/src/gateways/ws/remote-session-protocol.js

@@ -12,12 +12,15 @@ import { RemoteCommandLedger } from "../../harness/remote-command-ledger.js";
 import {
   ORIGIN,
   assertCanApprove,
+  assertCanAnswerInteraction,
   describeAuthorityChain,
 } from "../../lib/agent-authority.js";
+import { hasCompleteInteractionBinding } from "../../lib/interaction-binding.js";
 
 const CLIENT_EVENT_SCOPES = Object.freeze({
   prompt: "prompt",
   "approval.resolve": "approve",
+  "question.answer": "prompt",
   interrupt: "interrupt",
 });
 
@@ -30,7 +33,8 @@ function audit(server, entry) {
 }
 
 /**
- * Apply a remote-client control event (prompt / approval.resolve / interrupt)
+ * Apply a remote-client control event (prompt / approval.resolve /
+ * question.answer / interrupt)
  * idempotently when it carries a stable `commandId`. This is the ACTUAL takeover
  * path — a paired mobile/web device driving the host agent — and it does NOT
  * flow through message-dispatcher's execute/stream ledger, so without this a
@@ -448,7 +452,7 @@ export async function handleRemoteSessionPublish(
       requiredScope || "observe",
     );
     // Runtime/output events are host-only. Remote clients may publish only the
-    // three explicitly scoped control event types above.
+    // explicitly scoped control event types above.
     if (!requiredScope && session.hostClientId !== clientId) {
       throw new Error("Only the host can publish runtime events");
     }
@@ -468,6 +472,24 @@ export async function handleRemoteSessionPublish(
       ) {
         throw new Error("prompt content is required");
       }
+      if (message.event.type === "question.answer") {
+        if (
+          typeof message.event.requestId !== "string" ||
+          !message.event.requestId
+        ) {
+          throw new Error("question requestId is required");
+        }
+        if (!hasCompleteInteractionBinding(message.event.binding)) {
+          throw new Error("complete question binding is required");
+        }
+        assertCanAnswerInteraction({
+          origin: ORIGIN.REMOTE,
+          authenticated: true,
+          scopes: ["prompt"],
+          principalId: clientId,
+          sessionId: message.remoteSessionId,
+        });
+      }
       // Authority (§"权限来源与跨 Agent 授权边界"): a remote *approve* is honored
       // only from an authenticated, approve-scoped device — the SINGLE
       // authoritative rule, not just the per-device scope check above, so the
@@ -531,7 +553,9 @@ export async function handleRemoteSessionPublish(
               ? "control.prompt"
               : message.event.type === "approval.resolve"
                 ? "control.approval"
-                : "control.interrupt";
+                : message.event.type === "question.answer"
+                  ? "control.question"
+                  : "control.interrupt";
           audit(server, {
             sessionId: message.remoteSessionId,
             actor: clientId,
@@ -548,11 +572,23 @@ export async function handleRemoteSessionPublish(
                       authority: describeAuthorityChain(approvalEnvelope || {}),
                       forwarded: true,
                     }
-                  : { forwarded: true },
+                  : message.event.type === "question.answer"
+                    ? {
+                        requestId: message.event.requestId,
+                        authority: describeAuthorityChain({
+                          origin: ORIGIN.REMOTE,
+                          authenticated: true,
+                          scopes: ["prompt"],
+                          principalId: clientId,
+                          sessionId: message.remoteSessionId,
+                        }),
+                        forwarded: true,
+                      }
+                    : { forwarded: true },
           });
           // Hand the event to the host process. `message.event` carries any
-          // echoed approval binding, so the host gate can reject a stale /
-          // tampered verdict.
+          // echoed approval or interaction binding, so the host gate can
+          // reject a stale / tampered verdict.
           server._send(hostTarget.ws, {
             type: "remote-session-control",
             remoteSessionId: message.remoteSessionId,
@@ -599,6 +635,29 @@ export async function handleRemoteSessionPublish(
             // a verdict whose binding doesn't match the pending request.
             binding: message.event.binding ?? null,
           });
+        } else if (message.event.type === "question.answer") {
+          const authority = {
+            origin: ORIGIN.REMOTE,
+            authenticated: true,
+            scopes: ["prompt"],
+            principalId: clientId,
+            sessionId: message.remoteSessionId,
+          };
+          audit(server, {
+            sessionId: message.remoteSessionId,
+            actor: clientId,
+            action: "control.question",
+            detail: {
+              requestId: message.event.requestId,
+              authority: describeAuthorityChain(authority),
+            },
+          });
+          await handleSessionAnswer(server, message.id, ws, {
+            ...controlMessage,
+            requestId: message.event.requestId,
+            answer: message.event.answer ?? null,
+            binding: message.event.binding,
+          });
         } else if (message.event.type === "interrupt") {
           audit(server, {
             sessionId: message.remoteSessionId,

package/src/gateways/ws/ws-server.js

@@ -95,6 +95,7 @@ import {
 import { handleLlmChat } from "./llm-chat-protocol.js";
 import {
   cleanupBgAttachments,
+  handleBgAnswer,
   handleBgAttach,
   handleBgDetach,
   handleBgList,
@@ -113,6 +114,7 @@ import {
   handleArtifactShow,
 } from "./artifact-protocol.js";
 import { executionBroker } from "../../lib/process-execution-broker/index.js";
+import { collectWorkspacePluginBinSandboxPolicy } from "../../lib/plugin-runtime/bin.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -569,7 +571,8 @@ export class ChainlessChainWSServer extends EventEmitter {
       }
       const rulesMod = await import("../../lib/permission-rules.cjs");
       const mod = rulesMod.default || rulesMod;
-      if (!mod.parseRule(message.rule)) throw new Error("invalid permission rule");
+      if (!mod.parseRule(message.rule))
+        throw new Error("invalid permission rule");
       const { addRule } = await import("../../lib/settings-loader.cjs");
       const scope = ["project", "local", "user"].includes(message.scope)
         ? message.scope
@@ -767,6 +770,11 @@ export class ChainlessChainWSServer extends EventEmitter {
     return handleBgPrompt(this, clientId, id, ws, message);
   }
 
+  /** @private — answer a bound interaction in an attached background session */
+  async _handleBgAnswer(clientId, id, ws, message) {
+    return handleBgAnswer(this, clientId, id, ws, message);
+  }
+
   /** @private — stop the current turn of an attached background session */
   async _handleBgStopTurn(clientId, id, ws, message) {
     return handleBgStopTurn(this, clientId, id, ws, message);
@@ -1208,7 +1216,15 @@ export class ChainlessChainWSServer extends EventEmitter {
     if (this._taskManager) return this._taskManager;
     const { BackgroundTaskManager } =
       await import("../../harness/background-task-manager.js");
-    this._taskManager = new BackgroundTaskManager({ recoverOnStart: true });
+    this._taskManager = new BackgroundTaskManager({
+      recoverOnStart: true,
+      policyCwd: this.projectRoot,
+      resolveSandboxPolicy: ({ workspaceCwd, executionCwd }) =>
+        collectWorkspacePluginBinSandboxPolicy({
+          workspaceCwd,
+          executionCwd,
+        }),
+    });
     this._subscribeTaskNotifications();
     return this._taskManager;
   }

package/src/harness/background-task-manager.js

@@ -9,7 +9,7 @@
  */
 
 import { existsSync, mkdirSync, appendFileSync, readFileSync } from "node:fs";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { getHomeDir } from "../lib/paths.js";
@@ -42,9 +42,55 @@ const RECOVERABLE_TASK_STATUSES = new Set([
   TaskStatus.RUNNING,
 ]);
 
+function validatePinnedSandboxPolicy(policy) {
+  if (policy == null) return null;
+  if (
+    typeof policy !== "object" ||
+    Array.isArray(policy) ||
+    typeof policy.then === "function" ||
+    !Array.isArray(policy.requiredBoundaries) ||
+    policy.requiredBoundaries.length === 0 ||
+    policy.requiredBoundaries.some(
+      (boundary) => typeof boundary !== "string" || boundary.length === 0,
+    ) ||
+    !Object.isFrozen(policy) ||
+    !Object.isFrozen(policy.requiredBoundaries)
+  ) {
+    const error = new TypeError("invalid_background_task_sandbox_policy");
+    error.code = "ERR_BACKGROUND_TASK_SANDBOX_POLICY_INVALID";
+    error.sandboxReason = "invalid_background_task_sandbox_policy";
+    error.sandboxFailClosed = true;
+    throw error;
+  }
+  return policy;
+}
+
+function createUnsupportedSandboxError(sandboxPolicy) {
+  const requiredBoundaries = [...sandboxPolicy.requiredBoundaries];
+  const error = new Error(
+    `Background tasks cannot run without their required sandbox boundaries: ${requiredBoundaries.join(", ")}`,
+  );
+  error.code = "ERR_BACKGROUND_TASK_SANDBOX_UNSUPPORTED";
+  error.sandboxReason = "background_execution_unsupported";
+  error.sandboxFailClosed = true;
+  error.requiredBoundaries = requiredBoundaries;
+  error.actualGuarantees = [];
+  error.missingBoundaries = [...requiredBoundaries];
+  error.sandboxBackend = null;
+  error.sandboxCandidateBackend = null;
+  return error;
+}
+
 export class BackgroundTaskManager extends EventEmitter {
   constructor(options = {}) {
     super();
+    const resolveSandboxPolicy = options.resolveSandboxPolicy ?? null;
+    if (
+      resolveSandboxPolicy !== null &&
+      typeof resolveSandboxPolicy !== "function"
+    ) {
+      throw new TypeError("resolveSandboxPolicy must be a function or null");
+    }
     this.maxConcurrent = options.maxConcurrent || 3;
     this.heartbeatTimeout = options.heartbeatTimeout || 60000;
     this.historyLimit = options.historyLimit || 50;
@@ -54,6 +100,10 @@ export class BackgroundTaskManager extends EventEmitter {
       `${process.pid}@${process.platform}`;
     this.recoveryPolicy = options.recoveryPolicy || "claim-stale";
     this.staleNodeTimeout = options.staleNodeTimeout || 5 * 60 * 1000;
+    this._policyCwd = resolveSandboxPolicy
+      ? resolve(options.policyCwd || process.cwd())
+      : null;
+    this._resolveSandboxPolicy = resolveSandboxPolicy;
     this.tasks = new Map();
     this.processes = new Map();
     this._checkInterval = null;
@@ -72,12 +122,15 @@ export class BackgroundTaskManager extends EventEmitter {
       );
     }
 
+    const cwd = spec.cwd || process.cwd();
+    this._assertSandboxSupported(cwd);
+
     const id = `task-${Date.now()}-${createHash("sha256").update(Math.random().toString()).digest("hex").slice(0, 6)}`;
     const task = {
       id,
       type: spec.type || "shell",
       command: spec.command,
-      cwd: spec.cwd || process.cwd(),
+      cwd,
       description: spec.description || spec.command,
       status: TaskStatus.PENDING,
       createdAt: Date.now(),
@@ -111,6 +164,8 @@ export class BackgroundTaskManager extends EventEmitter {
       throw new Error(`Task ${taskId} is not pending (status: ${task.status})`);
     }
 
+    this._assertSandboxSupported(task.cwd);
+
     task.status = TaskStatus.RUNNING;
     task.startedAt = Date.now();
     task.lastHeartbeat = Date.now();
@@ -185,6 +240,19 @@ export class BackgroundTaskManager extends EventEmitter {
     return task;
   }
 
+  _assertSandboxSupported(executionCwd) {
+    if (!this._resolveSandboxPolicy) return;
+    const sandboxPolicy = validatePinnedSandboxPolicy(
+      this._resolveSandboxPolicy({
+        workspaceCwd: this._policyCwd,
+        executionCwd,
+      }),
+    );
+    if (sandboxPolicy) {
+      throw createUnsupportedSandboxError(sandboxPolicy);
+    }
+  }
+
   get(taskId) {
     return this.tasks.get(taskId) || null;
   }

package/src/harness/feature-flags.js

@@ -17,6 +17,8 @@ import { withFileLock } from "../lib/with-file-lock.js";
 import { getConfigPath } from "../lib/paths.js";
 import { createHash } from "node:crypto";
 import { hostname } from "node:os";
+import { mkdirSync } from "node:fs";
+import { dirname } from "node:path";
 
 const FLAG_REGISTRY = {
   BACKGROUND_TASKS: {
@@ -115,14 +117,19 @@ export function listFeatures() {
 export function setFeature(name, value) {
   // Serialize the read-modify-write across processes so two concurrent
   // `cc config features enable/disable` invocations don't clobber each other
-  // (and to space out writes so the atomic rename doesn't collide). Mirrors
-  // setConfigValue; the lock is best-effort and never hangs the CLI.
-  withFileLock(getConfigPath(), () => {
-    const config = loadConfig();
-    if (!config.features) config.features = {};
-    config.features[name] = value;
-    saveConfig(config);
-  });
+  // (and to space out writes so the atomic rename doesn't collide).
+  const configPath = getConfigPath();
+  mkdirSync(dirname(configPath), { recursive: true });
+  withFileLock(
+    configPath,
+    () => {
+      const config = loadConfig({ failIfUnavailable: true });
+      if (!config.features) config.features = {};
+      config.features[name] = value;
+      saveConfig(config);
+    },
+    { failIfUnavailable: true },
+  );
 }
 
 export function getFlagInfo(name) {