chainlesschain 0.162.181 → 0.162.183

package/src/commands/agent.js

@@ -757,6 +757,12 @@ export function registerAgentCommand(program) {
         process.stderr.write(
           "--permission-prompt-tool requires --mcp-config (the tool must come from a loaded MCP server).\n",
         );
+        // Complete worktree cleanup while the async command action is still
+        // running. Windows hosted runners do not reliably permit the exit
+        // handler to start the synchronous git subprocesses needed to remove
+        // the linked worktree, so the exit hook remains only a last-resort
+        // fallback for unexpected termination paths.
+        await _finishWorktree();
         process.exit(1);
       }
 
@@ -1125,6 +1131,15 @@ export function registerAgentCommand(program) {
             title: prompt.slice(0, 100),
             followUpArgv,
             worktree: _worktree,
+            governance: {
+              permissionMode: options.permissionMode || "default",
+              resourceBudget: {
+                maxTurns: options.maxTurns
+                  ? parseInt(options.maxTurns, 10)
+                  : null,
+                maxCostUsd,
+              },
+            },
           });
           if (_worktree) {
             // Ownership moves to the persisted background session only after

package/src/commands/background-session.js

@@ -2,6 +2,7 @@ import { existsSync, readFileSync } from "node:fs";
 import chalk from "chalk";
 import { logger } from "../lib/logger.js";
 import { readPrLinkLedger } from "../lib/pr-link-ledger.js";
+import { loadSideEffectLedger } from "../lib/side-effect-ledger-store.js";
 import executionBroker from "../lib/process-execution-broker/index.js";
 
 function formatAge(ms) {
@@ -74,6 +75,21 @@ export function formatBackgroundAgentDetails(
     lines.push(`  branch: ${session.branch || "-"}`);
     lines.push(`  baseSha: ${session.baseSha || "-"}`);
   }
+  if (session.governance) {
+    const governance = session.governance;
+    const budget = governance.resourceBudget || {};
+    lines.push(`  owner: ${governance.owner || "-"}`);
+    lines.push(`  permissionMode: ${governance.permissionMode || "default"}`);
+    lines.push(
+      `  budget: turns=${budget.maxTurns || "unlimited"} costUsd=${budget.maxCostUsd || "unlimited"}`,
+    );
+  }
+  if (session.sideEffects) {
+    const effects = session.sideEffects;
+    lines.push(
+      `  sideEffects: total=${effects.total || 0} unsettled=${effects.unsettled || 0} unknown=${effects.unknown || 0}`,
+    );
+  }
   if (session.phase) lines.push(`  phase: ${session.phase}`);
   if (session.pr?.number) {
     lines.push(
@@ -101,6 +117,27 @@ export function formatBackgroundAgentDetails(
   return lines.join("\n");
 }
 
+export function summarizeSideEffects(ledger) {
+  const ops =
+    ledger && typeof ledger.list === "function"
+      ? ledger.list()
+      : Array.isArray(ledger?.ops)
+        ? ledger.ops
+        : [];
+  const count = (state) => ops.filter((op) => op?.state === state).length;
+  return {
+    total: ops.length,
+    prepared: count("prepared"),
+    started: count("started"),
+    committed: count("committed"),
+    failed: count("failed"),
+    unknown: count("unknown"),
+    unsettled: ops.filter(
+      (op) => op?.state === "prepared" || op?.state === "started",
+    ).length,
+  };
+}
+
 function parseLines(value, fallback) {
   const n = Number(value);
   return Number.isFinite(n) && n > 0 ? Math.floor(n) : fallback;
@@ -447,6 +484,18 @@ async function runDashboardView(options = {}) {
     } catch {
       /* PR decoration is cosmetic */
     }
+    for (const s of sessions) {
+      if (!s.sessionId) continue;
+      try {
+        s.sideEffects = summarizeSideEffects(
+          loadSideEffectLedger(s.sessionId, {
+            failIfUnavailable: false,
+          }),
+        );
+      } catch {
+        /* side-effect decoration is cosmetic */
+      }
+    }
     return sessions;
   };
 

package/src/commands/plugin.js

@@ -20,10 +20,8 @@ import {
   removePlugin,
   updatePlugin,
   getPluginSettings,
-  setPluginSetting,
   searchRegistry,
   listRegistry,
-  registerInMarketplace,
   getPluginSummary,
   installPluginSkills,
   removePluginSkills,
@@ -404,8 +402,28 @@ export function registerPluginCommand(program) {
     .command("enable")
     .description("Enable a plugin")
     .argument("<name>", "Plugin name")
-    .action(async (name) => {
+    .option(
+      "--scope <scope>",
+      "Enable the unified-runtime install at this scope (user|project|local)",
+    )
+    .option("--json", "Output unified-runtime result as JSON")
+    .action(async (name, options) => {
       try {
+        if (options.scope) {
+          const { setPluginEnabled } =
+            await import("../lib/plugin-runtime/install.js");
+          const result = setPluginEnabled(name, true, {
+            scope: options.scope,
+            cwd: process.cwd(),
+          });
+          if (options.json) console.log(JSON.stringify(result, null, 2));
+          else {
+            logger.success(
+              `Enabled ${name} (${options.scope} scope). Reload active plugin sessions to apply the change.`,
+            );
+          }
+          return;
+        }
         enforcePluginPolicy(
           { name, action: "enable" },
           loadPluginManagedPolicy(),
@@ -436,8 +454,28 @@ export function registerPluginCommand(program) {
     .command("disable")
     .description("Disable a plugin")
     .argument("<name>", "Plugin name")
-    .action(async (name) => {
+    .option(
+      "--scope <scope>",
+      "Disable the unified-runtime install at this scope (user|project|local)",
+    )
+    .option("--json", "Output unified-runtime result as JSON")
+    .action(async (name, options) => {
       try {
+        if (options.scope) {
+          const { setPluginEnabled } =
+            await import("../lib/plugin-runtime/install.js");
+          const result = setPluginEnabled(name, false, {
+            scope: options.scope,
+            cwd: process.cwd(),
+          });
+          if (options.json) console.log(JSON.stringify(result, null, 2));
+          else {
+            logger.success(
+              `Disabled ${name} (${options.scope} scope). Reload active plugin sessions to apply the change.`,
+            );
+          }
+          return;
+        }
         const ctx = await bootstrap({ verbose: program.opts().verbose });
         if (!ctx.db) {
           logger.error("Database not available");
@@ -860,6 +898,7 @@ export function registerPluginCommand(program) {
       // plugin name) resolves to a git source the installer already handles.
       let installSource = source;
       let integritySha = null;
+      let sourceMetadata = null;
       const { isRemoteSource, resolveRemoteSource } =
         await import("../lib/plugin-runtime/remote-source.js");
       if (options.registry || isRemoteSource(source)) {
@@ -883,6 +922,19 @@ export function registerPluginCommand(program) {
           });
           installSource = resolved.source;
           integritySha = resolved.sha256;
+          sourceMetadata = {
+            type: "registry",
+            source: url,
+            registry: url,
+            package: name || source,
+            resolvedSource: resolved.source,
+            ref:
+              (typeof resolved.source === "string" &&
+                resolved.source.includes("#") &&
+                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
+              null,
+            offline: resolved.fromCache === true,
+          };
           if (resolved.fromCache) {
             logger.warn(
               chalk.yellow(
@@ -897,13 +949,31 @@ export function registerPluginCommand(program) {
         }
       }
 
+      let managed = null;
+      try {
+        managed = loadPluginManagedPolicy();
+      } catch (err) {
+        logger.error(`Managed plugin policy is invalid: ${err.message}`);
+        process.exitCode = 1;
+        return;
+      }
+      const requiresManagedSignature =
+        managed?.requireSignedPlugins === true ||
+        managed?.requireSignedPlugins === "require";
       const signature =
-        options.sha256 || options.signature || options.publicKey || integritySha
+        options.sha256 ||
+        options.signature ||
+        options.publicKey ||
+        integritySha ||
+        requiresManagedSignature
           ? {
               sha256: options.sha256 || integritySha,
               signatureFile: options.signature,
               publicKeyFile: options.publicKey,
-              requireSignature: Boolean(options.signature),
+              requireSignature:
+                Boolean(options.signature) || requiresManagedSignature,
+              trustedKeySha256: managed?.trustedPluginKeySha256 || null,
+              requireTrustedKey: requiresManagedSignature,
             }
           : null;
       try {
@@ -912,6 +982,9 @@ export function registerPluginCommand(program) {
           cwd: process.cwd(),
           force: options.force === true,
           signature,
+          sourceMetadata,
+          managedPolicy: managed,
+          policySource: options.registry || source,
         });
         const capNotice = await resolvePluginCapabilityNotice(
           res.name,
@@ -1060,8 +1133,21 @@ export function registerPluginCommand(program) {
         const trust = isPluginTrusted(r)
           ? chalk.green("trusted")
           : chalk.yellow("untrusted");
+        const state =
+          r.enabled === false
+            ? chalk.yellow("disabled")
+            : chalk.green("enabled");
+        const signed = r.integrity?.signature?.verified
+          ? chalk.green("signed")
+          : chalk.gray("unsigned");
+        const policy =
+          r.policy?.allowed === false
+            ? chalk.red("policy-blocked")
+            : r.policy?.managed
+              ? chalk.cyan("managed")
+              : "";
         logger.log(
-          `  ${ok} ${chalk.cyan(r.name)} v${r.version} ${chalk.gray(`[${r.scope}]`)} ${trust}`,
+          `  ${ok} ${chalk.cyan(r.name)} v${r.version} ${chalk.gray(`[${r.scope}]`)} ${state} ${trust} ${signed}${policy ? ` ${policy}` : ""}`,
         );
       }
     });
@@ -1456,22 +1542,162 @@ export function registerPluginCommand(program) {
   plugin
     .command("upgrade <source>")
     .description(
-      "Update a runtime plugin from its source (local dir or git); repoints .active",
+      "Update a runtime plugin from its pinned local, git, or registry source; repoints .active",
     )
     .option("--scope <scope>", `Scope to update in (${SCOPES})`, "user")
     .option("--force", "Reinstall even if the version is unchanged")
+    .option("--sha256 <hex>", "Expected SHA-256 of the manifest file")
+    .option("--signature <path>", "Detached Ed25519 signature of the manifest")
+    .option("--public-key <path>", "Public key for signature verification")
+    .option(
+      "--registry <url>",
+      "Resolve <source> as a plugin NAME in this registry URL",
+    )
+    .option(
+      "--name <plugin>",
+      "Plugin name to select from a multi-plugin registry",
+    )
+    .option("--token <token>", "Bearer token for a private registry")
+    .option(
+      "--allow-insecure-registry",
+      "Allow a plain-HTTP registry URL (MITM risk — trusted networks only)",
+    )
     .option(
       "--grant-capabilities",
       "Grant any newly declared capabilities during the upgrade (no separate consent step)",
     )
+    .option("--json", "Output as JSON")
     .action(async (source, options) => {
       const { updatePlugin } = await import("../lib/plugin-runtime/install.js");
+      let installSource = source;
+      let integritySha = null;
+      let sourceMetadata = null;
+      const { isRemoteSource, resolveRemoteSource } =
+        await import("../lib/plugin-runtime/remote-source.js");
+      if (options.registry || isRemoteSource(source)) {
+        const url = options.registry || source;
+        const name = options.registry ? source : options.name;
+        let config = null;
+        try {
+          const cm = await import("../lib/config-manager.js");
+          config = cm.loadConfig();
+        } catch {
+          config = null;
+        }
+        try {
+          const resolved = await resolveRemoteSource(url, {
+            name,
+            token: options.token,
+            config,
+            allowInsecure: options.allowInsecureRegistry === true,
+          });
+          installSource = resolved.source;
+          integritySha = resolved.sha256;
+          sourceMetadata = {
+            type: "registry",
+            source: url,
+            registry: url,
+            package: name || source,
+            resolvedSource: resolved.source,
+            ref:
+              (typeof resolved.source === "string" &&
+                resolved.source.includes("#") &&
+                resolved.source.slice(resolved.source.indexOf("#") + 1)) ||
+              null,
+            offline: resolved.fromCache === true,
+          };
+          if (resolved.fromCache && !options.json) {
+            logger.warn(
+              chalk.yellow(
+                "  ⚠ registry unreachable — using cached copy (offline)",
+              ),
+            );
+          }
+        } catch (err) {
+          logger.error(`Registry resolution failed: ${err.message}`);
+          process.exitCode = 1;
+          return;
+        }
+      }
+
+      let managed = null;
       try {
-        const res = updatePlugin(source, {
+        managed = loadPluginManagedPolicy();
+      } catch (err) {
+        logger.error(`Managed plugin policy is invalid: ${err.message}`);
+        process.exitCode = 1;
+        return;
+      }
+      const requiresManagedSignature =
+        managed?.requireSignedPlugins === true ||
+        managed?.requireSignedPlugins === "require";
+      const signature =
+        options.sha256 ||
+        options.signature ||
+        options.publicKey ||
+        integritySha ||
+        requiresManagedSignature
+          ? {
+              sha256: options.sha256 || integritySha,
+              signatureFile: options.signature,
+              publicKeyFile: options.publicKey,
+              requireSignature:
+                Boolean(options.signature) || requiresManagedSignature,
+              trustedKeySha256: managed?.trustedPluginKeySha256 || null,
+              requireTrustedKey: requiresManagedSignature,
+            }
+          : null;
+      try {
+        const res = updatePlugin(installSource, {
           scope: options.scope,
           cwd: process.cwd(),
           force: options.force,
+          signature,
+          sourceMetadata,
+          managedPolicy: managed,
+          policySource: options.registry || source,
         });
+        const upgradeNotice = await resolvePluginCapabilityNotice(
+          res.name,
+          options.scope,
+          process.cwd(),
+        );
+        if (res.updated || res.reinstalled)
+          await auditPluginInstall(
+            "upgrade",
+            { ...res, scope: options.scope },
+            installSource,
+            upgradeNotice,
+          );
+
+        if (options.json) {
+          let capabilitiesGranted = false;
+          if (
+            options.grantCapabilities &&
+            upgradeNotice &&
+            !upgradeNotice.consented
+          ) {
+            capabilitiesGranted = await grantInstalledPluginCapabilities(
+              res.name,
+              options.scope,
+              process.cwd(),
+            );
+          }
+          console.log(
+            JSON.stringify(
+              {
+                ...res,
+                scope: options.scope,
+                capabilities: upgradeNotice,
+                capabilitiesGranted,
+              },
+              null,
+              2,
+            ),
+          );
+          return;
+        }
+
         if (res.updated) {
           logger.success(
             `Updated ${res.name}: ${res.previousVersion ? `v${res.previousVersion} → ` : ""}v${res.version} (${options.scope} scope)`,
@@ -1489,20 +1715,6 @@ export function registerPluginCommand(program) {
         // upgrade that adds a capability shows a `⚠ capability consent required`
         // notice diffed against the prior consent, then either auto-grants
         // (--grant-capabilities) or blocks interactively to re-consent now.
-        const upgradeNotice = await resolvePluginCapabilityNotice(
-          res.name,
-          options.scope,
-          process.cwd(),
-        );
-        // Only a version that actually landed on disk is an install; an
-        // already-up-to-date no-op fetched nothing new to run.
-        if (res.updated || res.reinstalled)
-          await auditPluginInstall(
-            "upgrade",
-            { ...res, scope: options.scope },
-            source,
-            upgradeNotice,
-          );
         await applyCapabilityConsentGate(
           res.name,
           options.scope,

package/src/commands/session.js

@@ -1333,6 +1333,7 @@ export function registerSessionCommand(program) {
     "subagent",
     "tool",
     "mcp",
+    "plugin",
     "model",
   ];
 
@@ -1403,6 +1404,18 @@ export function registerSessionCommand(program) {
         );
         return;
       }
+      case "plugin": {
+        const rows = a.tools?.byPlugin || [];
+        if (rows.length === 0) return empty("plugin-attributed tool calls");
+        for (const r of rows)
+          toolRow(`${r.plugin}${r.version ? `@${r.version}` : ""}`, r);
+        logger.log(
+          chalk.gray(
+            "  turnTokens = tokens of turns that used the plugin (approximation; do not sum across rows)",
+          ),
+        );
+        return;
+      }
       default:
         break;
     }

package/src/data/changelog.json

@@ -1,6 +1,32 @@
 {
   "source": "CHANGELOG.md",
   "releases": [
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.183",
+      "cliVersions": ["0.4.74", "0.37.35", "0.162.182", "0.162.183"],
+      "date": "2026-07-27",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Added — cc CLI 0.162.183 + IDE quality, plugin, and worktree governance",
+          "body": "> `chainlesschain` **0.162.182 → 0.162.183**, VS Code\n> **0.37.34 → 0.37.35**, and JetBrains **0.4.73 → 0.4.74** (2026-07-27).\n> `@chainlesschain/personal-data-hub` remains **0.4.57** and\n> `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **IDE-native quality context**: both IDE bridges negotiate bounded\n  `cc-ide-quality/v1` test-result, coverage, and debugger snapshots with\n  Context v2 freshness metadata; VS Code notebook execution now carries its\n  real notebook context.\n- **Installation Doctor depth**: VS Code and JetBrains report Node/Java\n  availability plus managed-CLI and plugin-registry offline recovery state,\n  without probing executables from an untrusted workspace directory.\n- **Plugin lifecycle and supply-chain UI**: scoped enable/disable, source-aware\n  upgrades, live-session reload, signature/SBOM summaries, managed-policy\n  provenance, and sanitized registry/Git/local source metadata stay governed\n  by the CLI runtime.\n- **Plugin usage attribution**: compact transcripts and usage reports now\n  attribute plugin-bin and plugin-provided MCP calls by plugin/version without\n  persisting tool arguments.\n- **Supervised worktree tasks**: IDE-created isolated tasks run as background\n  worktree agents and display canonical lifecycle, owner/session, permission\n  mode, resource budget, and bounded side-effect counts. Team and batch rows\n  remain explicitly unmanaged until they expose equivalent durable state.\n- **Release validation**: publication remains gated on the exact release\n  commit passing CLI CI, CLI Strict Sandbox, background reconnect E2E, packaged\n  VSIX Extension Host gates, JetBrains unit/build/Remote Robot gates, and\n  public marketplace readback."
+        }
+      ]
+    },
+    {
+      "productVersion": null,
+      "cliVersion": "0.162.182",
+      "cliVersions": ["0.162.181", "0.162.182"],
+      "date": "2026-07-27",
+      "title": "",
+      "sections": [
+        {
+          "heading": "Fixed — cc CLI 0.162.182: attested native plugin sandbox closure",
+          "body": "> `chainlesschain` **0.162.181 → 0.162.182** (2026-07-27).\n> CLI-only release; `@chainlesschain/personal-data-hub` remains **0.4.57**\n> and `@chainlesschain/agent-sdk` remains **0.1.7**.\n\n- **One-shot native plugin execution contracts**: policy-bearing native plugin\n  bins must preserve the resolver-issued target, literal argv, plugin root, and\n  executable identity through the process broker. Replayed, copied, stale, or\n  asynchronous contracts fail closed before a target process is started.\n- **Linux strong boundary completion**: strict native launches accept only\n  attested static ELF executables for the current architecture, reject dynamic\n  loaders and malformed program headers, pin the plugin tree through file\n  descriptors, and enter the fixed bubblewrap filesystem/network policy\n  without exposing a mutable host path.\n- **Cross-platform identity hardening**: Windows AppContainer launches retain\n  attested target handles, while platform adapters revalidate executable and\n  plugin identities across probe, spawn, IPC, and detached launch boundaries.\n- **Release validation gate**: the exact release commit must pass `CLI CI` and\n  `CLI Strict Sandbox` on their configured Ubuntu, Windows, and macOS runners;\n  local tests are supplementary and cannot authorize publication."
+        }
+      ]
+    },
     {
       "productVersion": null,
       "cliVersion": "0.162.181",

package/src/gateways/terminal/PtyManager.js

@@ -1,9 +1,9 @@
 /**
  * PtyManager — ESM mirror of `desktop-app-vue/src/main/terminal/PtyManager.js`.
  *
- * Keep both copies in sync. The desktop copy targets Electron's CJS main
- * process; this one targets `cc ui` (Node ESM) so `cc ui` users also get
- * remote-terminal support via the same WS protocol.
+ * Keep their protocol and session behavior in sync. The desktop copy targets
+ * Electron's CJS main process; this one targets `cc ui` (Node ESM), whose host
+ * injects its own trusted workspace-policy resolver.
  *
  * Design notes — see docs/design/Android_Remote_Terminal_Plan_A.md §4:
  *   - node-pty loaded lazily so the module loads without the native
@@ -44,6 +44,24 @@ function resolveShellCmd(shell) {
   return shell;
 }
 
+function validatePinnedSandboxPolicy(policy) {
+  if (policy == null) return null;
+  if (
+    typeof policy !== "object" ||
+    Array.isArray(policy) ||
+    typeof policy.then === "function" ||
+    !Array.isArray(policy.requiredBoundaries) ||
+    policy.requiredBoundaries.length === 0 ||
+    !Object.isFrozen(policy) ||
+    !Object.isFrozen(policy.requiredBoundaries)
+  ) {
+    const error = new TypeError("invalid_pty_sandbox_policy");
+    error.code = "ERR_PTY_SANDBOX_POLICY_INVALID";
+    throw error;
+  }
+  return policy;
+}
+
 class PtySession {
   constructor({ id, shell, cwd, cols, rows, proc, createdAt, ringBuffer }) {
     this.id = id;
@@ -65,6 +83,16 @@ export class PtyManager extends EventEmitter {
   constructor(opts = {}) {
     super();
     this.config = { ...DEFAULT_CONFIG, ...(opts.config || {}) };
+    const resolveSandboxPolicy =
+      opts.resolveSandboxPolicy ?? opts._deps?.resolveSandboxPolicy ?? null;
+    if (
+      resolveSandboxPolicy !== null &&
+      typeof resolveSandboxPolicy !== "function"
+    ) {
+      throw new TypeError("resolveSandboxPolicy must be a function or null");
+    }
+    this._policyCwd = opts.policyCwd || process.cwd();
+    this._resolveSandboxPolicy = resolveSandboxPolicy;
     this._deps = {
       loadNodePty: opts._deps?.loadNodePty || (() => require("node-pty")),
       spawnPty: opts._deps?.spawnPty || null,
@@ -92,6 +120,19 @@ export class PtyManager extends EventEmitter {
       throw new Error("shell_not_allowed");
     }
 
+    const cwd = req.cwd || this.config.defaultCwd || process.cwd();
+    // A remote cwd may discover a stricter policy, but it must never replace
+    // the fixed workspace root supplied by the host. Resolve and validate the
+    // pinned policy before loading node-pty or allocating a native terminal.
+    const sandboxPolicy = this._resolveSandboxPolicy
+      ? validatePinnedSandboxPolicy(
+          this._resolveSandboxPolicy({
+            workspaceCwd: this._policyCwd,
+            executionCwd: cwd,
+          }),
+        )
+      : null;
+
     let pty;
     try {
       pty = this._deps.loadNodePty();
@@ -101,7 +142,6 @@ export class PtyManager extends EventEmitter {
       throw err;
     }
 
-    const cwd = req.cwd || this.config.defaultCwd || process.cwd();
     const cols = Number.isFinite(req.cols) ? req.cols : 80;
     const rows = Number.isFinite(req.rows) ? req.rows : 24;
     const cmd = resolveShellCmd(shell);
@@ -123,6 +163,7 @@ export class PtyManager extends EventEmitter {
       origin: "terminal:pty",
       policy: "allow",
       scope: "terminal",
+      ...(sandboxPolicy ? { sandboxPolicy } : {}),
     });
 
     const sessionId = randomUUID();

package/src/gateways/ws/ws-server.js

@@ -114,6 +114,7 @@ import {
   handleArtifactShow,
 } from "./artifact-protocol.js";
 import { executionBroker } from "../../lib/process-execution-broker/index.js";
+import { collectWorkspacePluginBinSandboxPolicy } from "../../lib/plugin-runtime/bin.js";
 
 export const _deps = {
   spawn: (...args) => executionBroker.spawn(...args),
@@ -1215,7 +1216,15 @@ export class ChainlessChainWSServer extends EventEmitter {
     if (this._taskManager) return this._taskManager;
     const { BackgroundTaskManager } =
       await import("../../harness/background-task-manager.js");
-    this._taskManager = new BackgroundTaskManager({ recoverOnStart: true });
+    this._taskManager = new BackgroundTaskManager({
+      recoverOnStart: true,
+      policyCwd: this.projectRoot,
+      resolveSandboxPolicy: ({ workspaceCwd, executionCwd }) =>
+        collectWorkspacePluginBinSandboxPolicy({
+          workspaceCwd,
+          executionCwd,
+        }),
+    });
     this._subscribeTaskNotifications();
     return this._taskManager;
   }