chainlesschain 0.166.82 → 0.166.84

package/src/repl/repl-tool-executor.js

@@ -0,0 +1,39 @@
+import {
+  captureAgentExecutionPolicy,
+  resolveAgentToolSelection,
+} from "../lib/agent-execution-policy.js";
+import {
+  executeTool as coreExecuteTool,
+  getAgentToolDefinitions,
+} from "../runtime/agent-core.js";
+
+/** Direct /auto and /plan tools share the startup ceiling and live permissions. */
+export function createReplToolExecutor(options, readLiveContext) {
+  const policy = captureAgentExecutionPolicy(options);
+  const selection = resolveAgentToolSelection(policy);
+  const ceiling =
+    selection.enabledToolNames !== null || selection.disabledTools.length > 0
+      ? Object.freeze(
+          getAgentToolDefinitions({
+            names: selection.enabledToolNames,
+            disabledTools: selection.disabledTools,
+            exactToolNames: true,
+          }).map((tool) => tool.function.name),
+        )
+      : null;
+  return (name, args, context = {}) => {
+    const live = readLiveContext();
+    return coreExecuteTool(name, args, {
+      ...live,
+      ...policy,
+      // Managed settings may tighten the explicit startup option while the
+      // REPL loads. Neither source can turn off the other's classifier.
+      classifyAllShell:
+        policy.classifyAllShell === true || live.classifyAllShell === true,
+      effectiveAllowedToolNames: ceiling,
+      sessionId: context.sessionId || null,
+      sessionBudget: context.sessionBudget || null,
+      signal: context.signal || null,
+    });
+  };
+}

package/src/runtime/agent-core.js

@@ -56,6 +56,11 @@ const { startSkillInvocation, settleSkillInvocation } = skillInvocationReceipt;
 import sharedCodingAgentPolicy from "./coding-agent-policy.cjs";
 import sharedShellPolicy from "./coding-agent-shell-policy.cjs";
 import sharedPermissionRules from "../lib/permission-rules.cjs";
+import { permissionRulesProviderAuthority } from "../lib/permission-authority.js";
+import {
+  captureHostToolPolicyAuthority,
+  hostToolPolicyAuthorityForChild,
+} from "../lib/host-tool-policy-authority.js";
 import sharedSettingsHooks from "../lib/settings-hooks.cjs";
 import sharedHookEvents from "../lib/settings-hook-events.js";
 import {
@@ -148,7 +153,12 @@ import {
   admitTool,
   buildToolAttribution,
 } from "../lib/agent-tool-admission.js";
-import { evaluateUnattendedShellAction } from "../lib/unattended-action-policy.js";
+import { captureAgentExecutionPolicy } from "../lib/agent-execution-policy.js";
+import {
+  evaluateUnattendedToolAction,
+  evaluateUnattendedGitAction,
+  evaluateUnattendedShellAction,
+} from "../lib/unattended-action-policy.js";
 import {
   formatProviderHttpError,
   formatProviderResponseError,
@@ -2416,6 +2426,7 @@ function projectPermissionAuthority({ authority, rules, tool, args, cwd }) {
     scoped: authority?.scoped || null,
     version: authority?.version || authority?.policyVersion || null,
     revision: authority?.revision ?? null,
+    settingsRevision: authority?.settingsRevision || null,
     headHash: authority?.headHash || null,
     verdict: {
       decision: verdict.decision || null,
@@ -2550,6 +2561,114 @@ function snapshotApprovalPolicyAuthority(approvalGate, sessionId) {
  */
 export async function executeTool(name, args, context = {}) {
   const liveExecutionContext = context;
+  try {
+    const executionPolicy = captureAgentExecutionPolicy(context);
+    context = {
+      ...context,
+      ...executionPolicy,
+    };
+    if (
+      context.unattendedActionPolicy?.unattended === true &&
+      ["schedule", "git", "spawn_sub_agent"].includes(name)
+    ) {
+      args = snapshotMcpJsonRpcInput(args || {});
+    }
+  } catch (error) {
+    return {
+      error:
+        error.code === "CC_UNATTENDED_POLICY_INVALID"
+          ? "[Unattended Action] Invalid policy; tool execution was blocked."
+          : "[Execution Policy] Invalid startup policy; tool execution was blocked.",
+      policy: {
+        decision: "deny",
+        via:
+          error.code === "CC_UNATTENDED_POLICY_INVALID"
+            ? "unattended-action-policy"
+            : "agent-execution-policy",
+        code: error.code,
+      },
+    };
+  }
+  let hostPolicyAuthority = null;
+  let entryHostPolicySnapshot = null;
+  try {
+    hostPolicyAuthority = captureHostToolPolicyAuthority(
+      context.hostManagedToolPolicyAuthority,
+    );
+    if (hostPolicyAuthority) {
+      // Every call samples the same live owner before the first async boundary.
+      // Decisions and their later revalidation use this immutable policy.
+      entryHostPolicySnapshot = hostPolicyAuthority.getSnapshot();
+      context = {
+        ...context,
+        hostManagedToolPolicy: entryHostPolicySnapshot.policy,
+      };
+    }
+  } catch (error) {
+    return {
+      error:
+        "[Host Policy] Tool policy authority is unavailable; execution was blocked.",
+      policy: {
+        decision: "blocked",
+        via: "host-policy-authority",
+        code: error.code,
+      },
+    };
+  }
+  function assertHostPolicyRevision() {
+    if (!hostPolicyAuthority) return;
+    if (
+      liveExecutionContext.hostManagedToolPolicyAuthority !==
+        hostPolicyAuthority ||
+      hostPolicyAuthority.getSnapshot() !== entryHostPolicySnapshot
+    ) {
+      const error = new Error(
+        "Host tool policy authority changed after admission",
+      );
+      error.code =
+        name === "run_shell"
+          ? "CC_SHELL_POLICY_AUTHORITY_CHANGED"
+          : "CC_HOST_TOOL_POLICY_AUTHORITY_CHANGED";
+      throw error;
+    }
+  }
+  let settingsPermissionAuthority = null;
+  let entrySettingsPermissionRevision = null;
+  try {
+    if (name === "run_shell") {
+      settingsPermissionAuthority = permissionRulesProviderAuthority(
+        context.permissionRulesProvider,
+      );
+      entrySettingsPermissionRevision =
+        settingsPermissionAuthority?.getSnapshot() || null;
+    }
+  } catch (error) {
+    return {
+      error:
+        "[Permission Authority] Settings authority is unavailable; execution was blocked.",
+      policy: {
+        decision: "blocked",
+        via: "permission-authority-load",
+        code: error.code,
+      },
+    };
+  }
+  function assertSettingsPermissionRevision() {
+    if (!settingsPermissionAuthority) return;
+    if (
+      permissionRulesProviderAuthority(
+        liveExecutionContext.permissionRulesProvider,
+      ) !== settingsPermissionAuthority ||
+      settingsPermissionAuthority.getSnapshot() !==
+        entrySettingsPermissionRevision
+    ) {
+      const error = new Error(
+        "Settings permission authority changed after admission",
+      );
+      error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+      throw error;
+    }
+  }
   let admittedApprovalGate = null;
   let admittedApprovalPolicyDigest = null;
   let entryPlanManager = null;
@@ -2736,6 +2855,22 @@ export async function executeTool(name, args, context = {}) {
   }
   const runtimeDescriptor =
     getRuntimeToolDescriptor(name) || localToolDescriptor;
+  if (context.unattendedActionPolicy?.unattended === true) {
+    const verdict = evaluateUnattendedToolAction(
+      name,
+      args,
+      context.unattendedActionPolicy,
+      {
+        external: Boolean(localToolExecutor),
+      },
+    );
+    if (!verdict.allow)
+      return {
+        error: `[Unattended Action] ${verdict.reason}; tool was not run.`,
+        unattendedAction: verdict,
+        policy: { decision: "deny", via: "unattended-action-policy" },
+      };
+  }
   let admittedToolAdmissionDigest = null;
   let toolAdmissionEvaluation;
   try {
@@ -2884,11 +3019,13 @@ export async function executeTool(name, args, context = {}) {
   let effectivePermissionRules = context.permissionRules || null;
   if (typeof context.permissionRulesProvider === "function") {
     try {
+      assertSettingsPermissionRevision();
       permissionAuthority = await context.permissionRulesProvider({
         cwd,
         tool: name,
         args,
       });
+      assertSettingsPermissionRevision();
       effectivePermissionRules =
         permissionAuthority?.rules || permissionAuthority || null;
       if (
@@ -3389,9 +3526,11 @@ export async function executeTool(name, args, context = {}) {
   let shellDispatchPolicyAuthority = null;
   if (name === "run_shell") {
     try {
+      assertSettingsPermissionRevision();
       const permissionRulesProvider = context.permissionRulesProvider || null;
       const approvalGate = context.approvalGate || null;
       const initialProjection = {
+        hostAuthority: hostPolicyAuthority?.getSnapshot() || null,
         permission: projectPermissionAuthority({
           authority: permissionAuthority,
           rules: validatePermissionRuleset(effectivePermissionRules),
@@ -3424,6 +3563,7 @@ export async function executeTool(name, args, context = {}) {
         classifyAllShell: context.classifyAllShell === true,
       };
       if (
+        initialProjection.hostAuthority !== entryHostPolicySnapshot ||
         approvalGate !== admittedApprovalGate ||
         digestPolicyAuthority(initialProjection.approval) !==
           admittedApprovalPolicyDigest ||
@@ -3450,6 +3590,18 @@ export async function executeTool(name, args, context = {}) {
           ? digestPolicyAuthority(context.sandbox)
           : null;
       shellDispatchPolicyAuthority = Object.freeze({
+        ...(settingsPermissionAuthority
+          ? {
+              subscribeSettingsPermissionRevision:
+                settingsPermissionAuthority.subscribePolicyRevision,
+            }
+          : {}),
+        ...(hostPolicyAuthority
+          ? {
+              subscribeHostPolicyRevision:
+                hostPolicyAuthority.subscribePolicyRevision,
+            }
+          : {}),
         policyVersion: `cc-shell-policy-authority/v1:${initialDigest}`,
         revalidateDockerSandbox() {
           if (
@@ -3464,6 +3616,8 @@ export async function executeTool(name, args, context = {}) {
         },
         async revalidate() {
           try {
+            assertHostPolicyRevision();
+            assertSettingsPermissionRevision();
             if (
               (liveExecutionContext.permissionRulesProvider || null) !==
                 permissionRulesProvider ||
@@ -3489,7 +3643,9 @@ export async function executeTool(name, args, context = {}) {
                 currentPermissionAuthority ||
                 null;
             }
+            assertSettingsPermissionRevision();
             const currentProjection = {
+              hostAuthority: hostPolicyAuthority?.getSnapshot() || null,
               permission: projectPermissionAuthority({
                 authority: currentPermissionAuthority,
                 rules: validatePermissionRuleset(currentPermissionRules),
@@ -3498,7 +3654,9 @@ export async function executeTool(name, args, context = {}) {
                 cwd,
               }),
               host: selectedHostToolPolicy(
-                liveExecutionContext.hostManagedToolPolicy || null,
+                hostPolicyAuthority
+                  ? entryHostPolicySnapshot.policy
+                  : liveExecutionContext.hostManagedToolPolicy || null,
                 name,
               ),
               plan: snapshotPlanToolAuthority(planManager, name, args),
@@ -3511,8 +3669,9 @@ export async function executeTool(name, args, context = {}) {
                 tool: name,
                 runtimeDescriptor,
                 localToolDescriptor,
-                hostManagedToolPolicy:
-                  liveExecutionContext.hostManagedToolPolicy,
+                hostManagedToolPolicy: hostPolicyAuthority
+                  ? entryHostPolicySnapshot.policy
+                  : liveExecutionContext.hostManagedToolPolicy,
               }).projection,
               approval: snapshotApprovalPolicyAuthority(
                 approvalGate,
@@ -3656,6 +3815,19 @@ export async function executeTool(name, args, context = {}) {
     }
   }
 
+  try {
+    assertHostPolicyRevision();
+  } catch (error) {
+    return {
+      error:
+        "[Host Policy] Tool policy changed during admission; execution was blocked.",
+      policy: {
+        decision: "blocked",
+        via: "host-policy-authority",
+        code: error.code,
+      },
+    };
+  }
   let sessionBudgetTool = null;
   if (typeof context.sessionBudget?.beginTool === "function") {
     const toolBinding = JSON.stringify({
@@ -3734,6 +3906,7 @@ export async function executeTool(name, args, context = {}) {
       permissionRulesProvider: context.permissionRulesProvider || null,
       effectiveAllowedToolNames: context.effectiveAllowedToolNames ?? null,
       hostManagedToolPolicy: context.hostManagedToolPolicy || null,
+      hostManagedToolPolicyAuthority: hostPolicyAuthority,
       externalToolDescriptors: context.externalToolDescriptors || null,
       externalToolExecutors: context.externalToolExecutors || null,
       mcpClient: context.mcpClient || null,
@@ -5266,8 +5439,10 @@ async function executeToolInner(
     workflowEffectProtocol = null,
     planManager = null,
     permissionRules = null,
+    permissionRulesProvider = null,
     effectiveAllowedToolNames = null,
     hostManagedToolPolicy,
+    hostManagedToolPolicyAuthority = null,
     externalToolDescriptors,
     externalToolExecutors,
     extraToolDefinitions = null,
@@ -6722,6 +6897,8 @@ async function executeToolInner(
         let authorityMonitor = null;
         let removePlanAuthorityListener = null;
         let removeApprovalAuthorityListener = null;
+        let removeHostAuthorityListener = null;
+        let removeSettingsAuthorityListener = null;
         if (needsEgress) {
           try {
             const { startEgressProxyWorker } =
@@ -6826,6 +7003,43 @@ async function executeToolInner(
                 );
               }
             }
+            if (
+              typeof shellDispatchPolicyAuthority?.subscribeHostPolicyRevision ===
+              "function"
+            ) {
+              removeHostAuthorityListener =
+                shellDispatchPolicyAuthority.subscribeHostPolicyRevision(() => {
+                  const error = new Error(
+                    "Host tool policy changed during Docker egress execution",
+                  );
+                  error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+                  authorityMonitor.revoke(error);
+                });
+              if (typeof removeHostAuthorityListener !== "function")
+                throw new TypeError(
+                  "host policy subscription must return an unsubscribe function",
+                );
+            }
+            if (
+              typeof shellDispatchPolicyAuthority?.subscribeSettingsPermissionRevision ===
+              "function"
+            ) {
+              removeSettingsAuthorityListener =
+                shellDispatchPolicyAuthority.subscribeSettingsPermissionRevision(
+                  () => {
+                    const error = new Error(
+                      "Settings permission policy changed during Docker egress execution",
+                    );
+                    error.code = "CC_SHELL_POLICY_AUTHORITY_CHANGED";
+                    authorityMonitor.revoke(error);
+                  },
+                );
+              if (typeof removeSettingsAuthorityListener !== "function") {
+                throw new TypeError(
+                  "settings revision subscription must return an unsubscribe function",
+                );
+              }
+            }
             authorityMonitor.start();
             await authorityMonitor.checkNow();
           } else {
@@ -6889,6 +7103,8 @@ async function executeToolInner(
             });
           }
         } finally {
+          removeSettingsAuthorityListener?.();
+          removeHostAuthorityListener?.();
           removeApprovalAuthorityListener?.();
           removePlanAuthorityListener?.();
           authorityMonitor?.stop();
@@ -7228,6 +7444,18 @@ async function executeToolInner(
       // command-execution bypass for a prompt-injected agent. Quoted args (a
       // commit message) keep their content via the quote-aware tokenizer.
       const gitArgs = tokenizeShellWords(normalizedCommand);
+      if (unattendedActionPolicy?.unattended === true) {
+        const verdict = evaluateUnattendedGitAction(gitArgs, {
+          ...unattendedActionPolicy,
+          attended: false,
+        });
+        if (!verdict.allow)
+          return attachDescriptor({
+            error: `[Unattended Action] ${verdict.reason}; git command was not run.`,
+            unattendedAction: verdict,
+            policy: { decision: "deny", via: "unattended-action-policy" },
+          });
+      }
       const res = _gitProcessDeps.run("git", gitArgs, {
         cwd: args.cwd || cwd,
         encoding: "utf8",
@@ -7379,8 +7607,10 @@ async function executeToolInner(
           // these boundaries; it never reconstructs a fresh default policy.
           planManager,
           permissionRules,
+          permissionRulesProvider,
           effectiveAllowedToolNames,
           hostManagedToolPolicy,
+          hostManagedToolPolicyAuthority,
           sandbox,
           additionalDirectories,
           approvalGate,
@@ -8687,6 +8917,7 @@ async function executeToolInner(
             ...(sessionBudget ? { sessionBudget } : {}),
             ...(hostResourceBudget ? { hostResourceBudget } : {}),
             ...(permissionRules ? { permissionRules } : {}),
+            ...(permissionRulesProvider ? { permissionRulesProvider } : {}),
             ...(hostManagedToolPolicy
               ? {
                   hostManagedToolPolicy: {
@@ -8695,6 +8926,14 @@ async function executeToolInner(
                   },
                 }
               : {}),
+            ...(hostManagedToolPolicyAuthority
+              ? {
+                  hostManagedToolPolicyAuthority:
+                    hostToolPolicyAuthorityForChild(
+                      hostManagedToolPolicyAuthority,
+                    ),
+                }
+              : {}),
             ...(planManager ? { planManager } : {}),
             ...(sandbox ? { sandbox } : {}),
             ...(Array.isArray(additionalDirectories)
@@ -11059,6 +11298,13 @@ async function _executeSpawnSubAgent(args, ctx) {
     ...(childHostManagedToolPolicy
       ? { hostManagedToolPolicy: childHostManagedToolPolicy }
       : {}),
+    ...(ctx.hostManagedToolPolicyAuthority
+      ? {
+          hostManagedToolPolicyAuthority: hostToolPolicyAuthorityForChild(
+            ctx.hostManagedToolPolicyAuthority,
+          ),
+        }
+      : {}),
     ...(ctx.planManager ? { planManager: ctx.planManager } : {}),
     ...(ctx.sandbox ? { sandbox: ctx.sandbox } : {}),
     ...(Array.isArray(ctx.additionalDirectories)
@@ -11333,6 +11579,16 @@ async function _executeSpawnSubAgent(args, ctx) {
 // ─── LLM chat with tools ─────────────────────────────────────────────────
 
 function getEffectiveToolDefinitions(options = {}) {
+  const hostAuthority = captureHostToolPolicyAuthority(
+    options.hermeticExecution === true
+      ? null
+      : options.hostManagedToolPolicyAuthority,
+  );
+  const hostPolicy = hostAuthority
+    ? hostAuthority.getSnapshot().policy
+    : options.hermeticExecution === true
+      ? null
+      : options.hostManagedToolPolicy;
   const persona =
     options.hermeticExecution === true
       ? null
@@ -11349,7 +11605,7 @@ function getEffectiveToolDefinitions(options = {}) {
     disabledTools: mergedDisabledTools,
     exactToolNames: options.exactToolNames === true,
     extraTools: [
-      ...(options.hostManagedToolPolicy?.toolDefinitions || []),
+      ...(hostPolicy?.toolDefinitions || []),
       ...(options.extraToolDefinitions || []),
     ],
   });
@@ -14266,6 +14522,13 @@ function permissionDecision(callId, tool, result) {
 }
 
 export async function* agentLoop(messages, options) {
+  const executionPolicy = captureAgentExecutionPolicy(options, {
+    hermetic: true,
+  });
+  options = {
+    ...options,
+    ...executionPolicy,
+  };
   const configuredChatFn = options.chatFn;
   const evolutionIngress =
     options.evolutionIngress == null
@@ -14323,6 +14586,7 @@ export async function* agentLoop(messages, options) {
     ? {
         ...options,
         hostManagedToolPolicy: null,
+        hostManagedToolPolicyAuthority: null,
         extraToolDefinitions: [],
       }
     : options;
@@ -14388,6 +14652,9 @@ export async function* agentLoop(messages, options) {
     hostManagedToolPolicy: hermeticExecution
       ? null
       : options.hostManagedToolPolicy || null,
+    hostManagedToolPolicyAuthority: hermeticExecution
+      ? null
+      : captureHostToolPolicyAuthority(options.hostManagedToolPolicyAuthority),
     externalToolDescriptors: hermeticExecution
       ? null
       : options.externalToolDescriptors || null,

package/src/runtime/agent-runtime.js

@@ -1,4 +1,5 @@
 import chalk from "chalk";
+import { captureAgentExecutionPolicy } from "../lib/agent-execution-policy.js";
 import { defaultOpenBrowser } from "../lib/mcp-oauth.js";
 import path from "path";
 import {
@@ -335,19 +336,30 @@ export class AgentRuntime {
   }
 
   async startAgentSession() {
+    const executionPolicy = captureAgentExecutionPolicy(this.policy);
+    const launchPolicy = Object.freeze({
+      ...this.policy,
+      // Preserve the public envelope's absent optional fields. Captured null
+      // defaults still apply at the REPL entry, before its first await.
+      ...Object.fromEntries(
+        Object.entries(executionPolicy).filter(([field]) =>
+          Object.hasOwn(this.policy, field),
+        ),
+      ),
+    });
     if (this.evolutionIngress !== null) {
       await this.evolutionIngress.start();
     }
     this.emit(RUNTIME_EVENTS.RUNTIME_START, {
       kind: this.kind,
-      policy: this.policy,
+      policy: launchPolicy,
     });
     this.emit(RUNTIME_EVENTS.SESSION_START, {
       kind: this.kind,
-      sessionId: this.policy.sessionId || null,
+      sessionId: launchPolicy.sessionId || null,
     });
     const result = await this.deps.startAgentRepl({
-      ...this.policy,
+      ...launchPolicy,
       ...this.runtimeAdmissionDependencies,
       ...(this.memoryPolicyReceiptWriter === null
         ? {}

package/src/runtime/headless-runner.js

@@ -23,6 +23,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import { captureAgentExecutionPolicy } from "../lib/agent-execution-policy.js";
 import { bootstrap } from "./bootstrap.js";
 import {
   buildSystemPrompt,
@@ -348,10 +349,7 @@ export function resolvePermissionMode(mode = "default") {
  * @returns {string[]|null} null = all tools (subject to disabledTools)
  */
 export function resolveEnabledTools({ allowedTools, readOnly } = {}) {
-  let names =
-    Array.isArray(allowedTools) && allowedTools.length > 0
-      ? [...allowedTools]
-      : null;
+  let names = Array.isArray(allowedTools) ? [...allowedTools] : null;
   if (readOnly) {
     names = names
       ? names.filter((n) => READ_ONLY_TOOLS.includes(n))
@@ -626,6 +624,13 @@ async function withHeadlessSessionHostLease(options, deps, task) {
 }
 
 export async function runAgentHeadless(options = {}, deps = {}) {
+  const executionPolicy = captureAgentExecutionPolicy(options, {
+    hermetic: true,
+  });
+  options = {
+    ...options,
+    ...executionPolicy,
+  };
   const trustedWorkspaceRoot = options.cwd || process.cwd();
   const pipeState = { closed: false };
   const stdout = deps.stdout || process.stdout;
@@ -2617,6 +2622,7 @@ async function runAgentHeadlessInWorkspace(
       : { skillRetrievalRevocationReader }),
     additionalDirectories,
     sandbox: options.sandbox || null,
+    shellPolicyOverrides: options.shellPolicyOverrides,
     sessionId,
     sessionBudget: options.sessionBudget || null,
     hostResourceBudget,
@@ -2653,6 +2659,9 @@ async function runAgentHeadlessInWorkspace(
     hermeticExecution,
     iterationBudget: budget,
     toolAdmission: hermeticExecution ? null : options.toolAdmission || null,
+    unattendedActionPolicy: hermeticExecution
+      ? null
+      : options.unattendedActionPolicy,
     ...(Object.keys(headlessInteraction).length > 0
       ? { interaction: headlessInteraction }
       : {}),

package/src/runtime/headless-stream.js

@@ -17,6 +17,7 @@
  */
 
 import { randomUUID } from "node:crypto";
+import { captureAgentExecutionPolicy } from "../lib/agent-execution-policy.js";
 import { TaskWorklog } from "../lib/context-memory-kernel/task-worklog-port.js";
 import { isProxy } from "node:util/types";
 import {
@@ -1468,6 +1469,11 @@ async function withStreamSessionHostLease(options, deps, streamCleanup, task) {
 }
 
 export async function runAgentHeadlessStream(options = {}, deps = {}) {
+  const executionPolicy = captureAgentExecutionPolicy(options);
+  options = {
+    ...options,
+    ...executionPolicy,
+  };
   const trustedWorkspaceRoot = options.cwd || process.cwd();
   const input = deps.input || process.stdin;
   const pipeState = { closed: false };
@@ -3597,6 +3603,8 @@ async function runAgentHeadlessStreamInWorkspace(
     apiKey,
     cwd,
     additionalDirectories,
+    sandbox: options.sandbox,
+    shellPolicyOverrides: options.shellPolicyOverrides,
     ...(skillOutcomeIndex === null ? {} : { skillOutcomeIndex }),
     ...captureSkillRuntimeDependencies(options, evolutionIngress?.tenantId),
     ...(skillVectorAuthority === null ? {} : { skillVectorAuthority }),
@@ -3624,6 +3632,7 @@ async function runAgentHeadlessStreamInWorkspace(
     permissionRulesProvider,
     settingsHooks,
     toolAdmission: options.toolAdmission || null,
+    unattendedActionPolicy: options.unattendedActionPolicy,
     classifyAllShell,
     enabledToolNames,
     disabledTools,

package/src/runtime/policies/agent-policy.js

@@ -1,9 +1,12 @@
+import { captureAgentExecutionPolicy } from "../../lib/agent-execution-policy.js";
+
 export function resolveAgentPolicy({
   config = null,
   overrides = {},
   defaults = {},
 } = {}) {
   const llm = config?.llm || {};
+  const executionPolicy = captureAgentExecutionPolicy(overrides);
 
   return {
     model: overrides.model || llm.model || defaults.model || "qwen2:7b",
@@ -28,10 +31,8 @@ export function resolveAgentPolicy({
     bundlePath: overrides.bundlePath || null,
     remoteSessionRelayUrl: overrides.remoteSessionRelayUrl || null,
     remoteSessionPeerId: overrides.remoteSessionPeerId || null,
-    additionalDirectories: Array.isArray(overrides.additionalDirectories)
-      ? overrides.additionalDirectories
-      : [],
-    sandbox: overrides.sandbox || null,
+    ...executionPolicy,
+    additionalDirectories: executionPolicy.additionalDirectories || [],
     autoCheckpoint: overrides.autoCheckpoint === true,
     // Managed workspace checkpoints are consumed by both headless runners and
     // the interactive REPL. Keep these explicit because this policy is an

package/src/assets/web-panel/assets/ChatBubbleRenderer-pPuUDG2V.js

@@ -1 +0,0 @@
-import{I as v,P as u,J as S,U as n,R as a,S as y,K as x,Q as C,V as w,_ as B,b as s}from"./vendor-Bn1JzzAn.js";import{_ as k}from"./index-DD-V-N_m.js";import"./icons-DG5UD-6K.js";const N={__name:"ChatBubbleRenderer",props:{event:{type:Object,required:!0}},setup(c,{expose:d}){d();const t=c,r=s(()=>{const e=t.event.content||{};return e.text||e.body||e.message||e.title||JSON.stringify(e).slice(0,200)}),i=s(()=>{const e=t.event.content||{};return e.from||e.sender||e.senderName||t.event.actor||"(unknown)"}),l=s(()=>{const e=(t.event.actor||"").toLowerCase();return e.includes("self")||e==="me"||e.endsWith("_self")}),o=s(()=>{const e=t.event.source.adapter||"";return e.startsWith("messaging-qq")?"magenta":e==="wechat"?"green":"blue"}),m=s(()=>{if(!t.event.occurredAt)return"";try{const e=new Date(t.event.occurredAt),p=e.getFullYear(),f=String(e.getMonth()+1).padStart(2,"0"),g=String(e.getDate()).padStart(2,"0"),b=String(e.getHours()).padStart(2,"0"),h=String(e.getMinutes()).padStart(2,"0");return`${p}-${f}-${g} ${b}:${h}`}catch{return""}}),_={props:t,messageText:r,actorLabel:i,isMine:l,adapterColor:o,formattedTime:m,computed:s};return Object.defineProperty(_,"__isScriptSetup",{enumerable:!1,value:!0}),_}},T={class:"bubble"},L={class:"meta"},M={class:"actor"},R={class:"time"},V={class:"body"};function q(c,d,t,r,i,l){const o=v("a-tag");return u(),S("div",{class:B(["chat-row",{mine:r.isMine}])},[n("div",T,[n("div",L,[n("span",M,a(r.actorLabel),1),n("span",R,a(r.formattedTime),1)]),n("div",V,a(r.messageText),1),t.event.source.adapter?(u(),y(o,{key:0,class:"src",color:r.adapterColor},{default:x(()=>[C(a(t.event.source.adapter),1)]),_:1},8,["color"])):w("v-if",!0)])],2)}const z=k(N,[["render",q],["__scopeId","data-v-49238629"],["__file","/tmp/cc-web-panel-UxuLZz/repo/packages/web-panel/src/components/pdh/renderers/ChatBubbleRenderer.vue"]]);export{z as default};