praxis-agent 0.11.0 → 0.12.0

package/README.md

@@ -87,7 +87,7 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   `/rewind`, runtime `/cd`, transcript-free
   `/btw` side questions with background-Agent handoff, interactive
   `/background` terminal handoff, unified `/status`/`/config`/`/usage` settings
-  tabs, `/mcp`, `/memory` shared
+  tabs, `/sandbox` mode/dependency/override/config controls, `/mcp`, `/memory` shared
   instruction and auto-memory access, and live extension-reload controls,
   cursor/history composer, per-session model/effort/permission controls,
   context/status/skill/task dashboards, prompt stash and continuation shortcuts,
@@ -121,6 +121,10 @@ troubleshooting. Run `praxis --help` for the authoritative command surface.
   constraints, internal auto-memory/session/task path handling, compound `cd` +
   Git protection, mode-ordered `acceptEdits` handling, live raw/resolved-path
   grants for external directories,
+  Claude-compatible opt-in Bash sandboxing with filesystem and network
+  isolation, explicit ask/deny precedence, sandbox-only auto-allow,
+  write-allowlist/deny-within-allow enforcement, per-command overrides and
+  exclusions, violation reporting, and bare-repository control-file cleanup,
   safe-property Skill auto-allow, interactive
   workspace-directory add/remove controls, path confinement, credential
   redaction, and sanitized child processes.

package/dist/cli/interactive.d.ts

@@ -18,6 +18,7 @@ import { loadTuiKeybindings, type TuiKeybindingsFile } from './tui/keybindings.j
 import { completeTuiWorkspaceDirectory, resolveTuiWorkspaceDirectory } from './tui/workspace-directories.js';
 import { type TuiThemeSettings } from './tui/theme.js';
 import { type CustomThemeBase, type CustomThemeToken, type TuiCustomTheme } from './tui/custom-themes.js';
+import { type TuiSandboxStore } from './tui/sandbox-settings.js';
 import { type ConfigSettingsTarget } from './tui/config-settings.js';
 import { type PraxisRuntimeSettings } from './tui/runtime-settings.js';
 import { type TuiNotificationWriter } from './tui/terminal-notifications.js';
@@ -152,6 +153,7 @@ interface InteractiveAppProps {
         }): Promise<void>;
         remove?(rule: TuiPermissionRule): Promise<void>;
     };
+    sandboxStore?: TuiSandboxStore;
     recentlyDeniedStore?: RecentlyDeniedStore;
     themeStore?: {
         load(): Promise<TuiThemeSettings>;
@@ -174,7 +176,7 @@ interface InteractiveAppProps {
     notificationWriter?: TuiNotificationWriter;
     elicitationUrlOpener?: (url: string) => void | Promise<void>;
 }
-export declare function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory, signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader, allowNewSession, resume, display, terminalWidth, slashCommands, agents, allowDangerouslySkipPermissions, additionalDirectories, diffLoader, fileLoader, externalEditor, keybindingsConfigRoot, keybindingsFile, keybindingsLoader, keybindingsEditor, memoryFilesLoader, memoryEditor, memoryFolderOpener, suspendProcess, clipboardReader, clipboardWriter, sideQuestionClipboardWriter, exportWriter, permissionRuleStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver, workspaceDirectoryCompleter, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, elicitationUrlOpener, }: InteractiveAppProps): import("react").JSX.Element;
+export declare function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory, signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader, allowNewSession, resume, display, terminalWidth, slashCommands, agents, allowDangerouslySkipPermissions, additionalDirectories, diffLoader, fileLoader, externalEditor, keybindingsConfigRoot, keybindingsFile, keybindingsLoader, keybindingsEditor, memoryFilesLoader, memoryEditor, memoryFolderOpener, suspendProcess, clipboardReader, clipboardWriter, sideQuestionClipboardWriter, exportWriter, permissionRuleStore, sandboxStore: suppliedSandboxStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver, workspaceDirectoryCompleter, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, elicitationUrlOpener, }: InteractiveAppProps): import("react").JSX.Element;
 export declare function runInteractive(options: {
     factory: InteractiveServiceFactory;
     initialPrompt?: string;

package/dist/cli/interactive.js

@@ -33,6 +33,8 @@ import { commitElicitationText, createTuiElicitationForm, elicitationFormIsValid
 import { openTuiUrl } from './tui/open-url.js';
 import { projectTuiToolPermission, ToolPermissionDialog, } from './tui/tool-permission.js';
 import { ConfigDashboard, projectConfigRows } from './tui/config-dashboard.js';
+import { SandboxDashboard, tuiSandboxTabs } from './tui/sandbox-dashboard.js';
+import { createTuiSandboxStore, } from './tui/sandbox-settings.js';
 import { loadConfigSettings, saveConfigSetting, configSettingDefinition, resolveConfigSettingsLocation, } from './tui/config-settings.js';
 import { projectRuntimeSettings, loadRuntimeSettings, } from './tui/runtime-settings.js';
 import { autoUpdateTarget, copyCandidates, externalEditorInitialContent, formatTurnDuration, questionTimeoutMilliseconds, sessionRecap, spinnerTip, shouldShowCopyPicker, } from './tui/runtime-interactions.js';
@@ -232,7 +234,18 @@ function ordinal(value) {
             return `${value}th`;
     }
 }
-export function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory = [], signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader = false, allowNewSession = true, resume, display = { version: 'dev', cwd: process.cwd() }, terminalWidth, slashCommands = EMPTY_SLASH_COMMANDS, agents = EMPTY_AGENTS, allowDangerouslySkipPermissions = false, additionalDirectories = [], diffLoader, fileLoader, externalEditor = editTuiPrompt, keybindingsConfigRoot, keybindingsFile = ensureTuiKeybindingsFile, keybindingsLoader = loadTuiKeybindings, keybindingsEditor = openTuiEditorFile, memoryFilesLoader = (configRoot, cwd) => loadTuiMemoryFiles({ configRoot, cwd }), memoryEditor = openTuiEditorFile, memoryFolderOpener = openTuiMemoryFolder, suspendProcess = suspendTuiProcess, clipboardReader = readTuiClipboard, clipboardWriter = writeTuiClipboard, sideQuestionClipboardWriter = writeTuiOsc52Clipboard, exportWriter = writeConversationExport, permissionRuleStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver = resolveTuiWorkspaceDirectory, workspaceDirectoryCompleter = completeTuiWorkspaceDirectory, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, elicitationUrlOpener = openTuiUrl, }) {
+const HIDDEN_TUI_SLASH_COMMANDS = new Set([
+    'background',
+    'new',
+    'output-style',
+    'reload-skills',
+    'sessions',
+    'skill',
+    'terminal-setup',
+    'update',
+    'usage',
+]);
+export function InteractiveApp({ factory, initialSessions, initialPrompt, initialHistory = [], signal, onCancel, onTurnChange, onCleanup, onRendererChange, onBackground, axScreenReader = false, allowNewSession = true, resume, display = { version: 'dev', cwd: process.cwd() }, terminalWidth, slashCommands = EMPTY_SLASH_COMMANDS, agents = EMPTY_AGENTS, allowDangerouslySkipPermissions = false, additionalDirectories = [], diffLoader, fileLoader, externalEditor = editTuiPrompt, keybindingsConfigRoot, keybindingsFile = ensureTuiKeybindingsFile, keybindingsLoader = loadTuiKeybindings, keybindingsEditor = openTuiEditorFile, memoryFilesLoader = (configRoot, cwd) => loadTuiMemoryFiles({ configRoot, cwd }), memoryEditor = openTuiEditorFile, memoryFolderOpener = openTuiMemoryFolder, suspendProcess = suspendTuiProcess, clipboardReader = readTuiClipboard, clipboardWriter = writeTuiClipboard, sideQuestionClipboardWriter = writeTuiOsc52Clipboard, exportWriter = writeConversationExport, permissionRuleStore, sandboxStore: suppliedSandboxStore, recentlyDeniedStore: suppliedRecentlyDeniedStore, terminalSetup: terminalSetupOverride, themeStore, initialThemeSettings, initialThemeLoadError, workspaceDirectoryResolver = resolveTuiWorkspaceDirectory, workspaceDirectoryCompleter = completeTuiWorkspaceDirectory, runtimeSettings: suppliedRuntimeSettings, runtimeSettingsTarget, notificationWriter, elicitationUrlOpener = openTuiUrl, }) {
     const { exit, suspendTerminal, waitUntilRenderFlush } = useApp();
     const width = useTerminalWidth(terminalWidth);
     const keybindingsRoot = useMemo(() => resolve(keybindingsConfigRoot ??
@@ -369,6 +382,18 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
         permissionMode: permissionMode(display.permissionMode),
         additionalDirectories: [...new Set(additionalDirectories)],
     }));
+    const sandboxStore = useMemo(() => suppliedSandboxStore ??
+        createTuiSandboxStore({
+            configRoot: keybindingsRoot,
+            cwd: runtimeCwd,
+            homeDirectory: homedir(),
+            additionalDirectories: runtimePreferences.additionalDirectories,
+        }), [
+        keybindingsRoot,
+        runtimeCwd,
+        runtimePreferences.additionalDirectories,
+        suppliedSandboxStore,
+    ]);
     const runtimePreferencesRef = useRef(runtimePreferences);
     const [permission, setPermission] = useState(null);
     const permissionRef = useRef(null);
@@ -3157,6 +3182,62 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
             }
             return;
         }
+        if (earlyMenu?.kind === 'sandbox') {
+            if (key.escape || value === '\u001B') {
+                updateMenu(null);
+                return;
+            }
+            const tabs = tuiSandboxTabs(earlyMenu.snapshot);
+            if (key.leftArrow || key.rightArrow || key.tab) {
+                const index = tabs.indexOf(earlyMenu.tab);
+                const direction = key.leftArrow || (key.tab && key.shift) ? -1 : 1;
+                const tab = tabs[Math.max(0, Math.min(tabs.length - 1, index + direction))] ??
+                    earlyMenu.tab;
+                updateMenu({ ...earlyMenu, tab, selectedIndex: 0 });
+                return;
+            }
+            const rowCount = earlyMenu.tab === 'mode'
+                ? 3
+                : earlyMenu.tab === 'overrides' && earlyMenu.snapshot.settings.enabled
+                    ? 2
+                    : 0;
+            if (rowCount > 0 && (key.upArrow || key.downArrow)) {
+                updateMenu({
+                    ...earlyMenu,
+                    selectedIndex: Math.max(0, Math.min(rowCount - 1, earlyMenu.selectedIndex + (key.upArrow ? -1 : 1))),
+                });
+                return;
+            }
+            if (rowCount > 0 && key.return) {
+                const saving = (async () => {
+                    setBusy(true);
+                    try {
+                        const snapshot = earlyMenu.tab === 'mode'
+                            ? await sandboxStore.setMode(['auto-allow', 'regular', 'disabled'][earlyMenu.selectedIndex] ?? 'auto-allow')
+                            : await sandboxStore.setAllowUnsandboxedCommands(earlyMenu.selectedIndex === 0);
+                        await retireService();
+                        const tabs = tuiSandboxTabs(snapshot);
+                        updateMenu({
+                            kind: 'sandbox',
+                            tab: tabs.includes(earlyMenu.tab)
+                                ? earlyMenu.tab
+                                : (tabs[0] ?? 'dependencies'),
+                            selectedIndex: earlyMenu.selectedIndex,
+                            snapshot,
+                        });
+                    }
+                    catch (error) {
+                        warn(error);
+                    }
+                    finally {
+                        setBusy(false);
+                    }
+                })();
+                onTurnChange?.(saving);
+                void saving.finally(() => onTurnChange?.(null));
+            }
+            return;
+        }
         if (earlyMenu?.kind === 'config') {
             if (key.escape || value === '\u001B') {
                 if (earlyMenu.searchFocused && earlyMenu.query) {
@@ -4673,9 +4754,13 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
                 commandNameQuery === selectedCommand.name.toLocaleLowerCase();
             const selectedCommandMatchesName = selectedCommand !== undefined &&
                 selectedCommand.name.toLocaleLowerCase().startsWith(commandNameQuery);
+            const exactHiddenCommand = HIDDEN_TUI_SLASH_COMMANDS.has(commandNameQuery);
             if (selectedCommand &&
                 (key.tab ||
-                    (key.return && !exactSelectedCommand && selectedCommandMatchesName))) {
+                    (key.return &&
+                        !exactSelectedCommand &&
+                        !exactHiddenCommand &&
+                        selectedCommandMatchesName))) {
                 updateComposerInput(`/${selectedCommand.name} `);
                 setCommandPaletteOpen(false);
                 return;
@@ -4702,6 +4787,7 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
             if (!prompt || prompt === '!')
                 return;
             const copyCommand = /^\/copy(?:\s+(\d+))?$/u.exec(prompt);
+            const sandboxCommand = /^\/sandbox(?:\s+([\s\S]+))?$/u.exec(prompt);
             const tuiCommand = /^\/tui(?:\s+(default|fullscreen))?$/u.exec(prompt);
             const renameCommand = /^\/rename(?:\s+(.+))?$/u.exec(prompt);
             const cdCommand = /^\/cd(?:\s+(.+))?$/u.exec(prompt);
@@ -4883,6 +4969,52 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
                 append({ kind: 'user', text: prompt });
                 updateMenu({ kind: 'export', selectedIndex: 0 });
             }
+            else if (sandboxCommand) {
+                const operation = (async () => {
+                    setBusy(true);
+                    try {
+                        const args = sandboxCommand[1]?.trim();
+                        if (args) {
+                            const exclude = /^exclude(?:\s+([\s\S]+))?$/u.exec(args);
+                            if (!exclude) {
+                                throw new Error(`Unknown subcommand "${args.split(/\s+/u)[0] ?? args}". Available subcommand: exclude`);
+                            }
+                            if (!exclude[1]?.trim()) {
+                                throw new Error('Please provide a command pattern to exclude (e.g. /sandbox exclude "npm run test:*")');
+                            }
+                            const result = await sandboxStore.exclude(exclude[1]);
+                            await retireService();
+                            append({
+                                kind: 'local-result',
+                                text: `Added "${result.pattern}" to excluded commands in ${result.settingsPath}`,
+                            });
+                            return;
+                        }
+                        const snapshot = await sandboxStore.load();
+                        if (!snapshot.supported) {
+                            throw new Error('Sandboxing is currently only supported on macOS, Linux, and WSL2.');
+                        }
+                        if (snapshot.unavailableReason?.includes('not in sandbox.enabledPlatforms')) {
+                            throw new Error(snapshot.unavailableReason);
+                        }
+                        const tabs = tuiSandboxTabs(snapshot);
+                        updateMenu({
+                            kind: 'sandbox',
+                            tab: tabs[0] ?? 'dependencies',
+                            selectedIndex: 0,
+                            snapshot,
+                        });
+                    }
+                    catch (error) {
+                        warn(error);
+                    }
+                    finally {
+                        setBusy(false);
+                    }
+                })();
+                onTurnChange?.(operation);
+                void operation.finally(() => onTurnChange?.(null));
+            }
             else if (prompt === '/permissions') {
                 const loading = (async () => {
                     setBusy(true);
@@ -5197,7 +5329,7 @@ export function InteractiveApp({ factory, initialSessions, initialPrompt, initia
                                         ? `restore ${menu.point.fileChanges.join(', ')}.`
                                         : 'be unchanged.'] }), _jsx(Text, { children: " " }), rewindActions(menu.point).map((option, index) => (_jsxs(Text, { inverse: menu.selectedIndex === index, children: [menu.selectedIndex === index ? '❯ ' : '  ', index + 1, ". ", option.label] }, option.action))), _jsx(Text, { children: " " }), _jsx(Text, { color: activePalette.warning, children: "\u26A0 Rewinding does not affect files edited manually or via bash." })] })) : menu?.kind === 'rewind-context' ? (_jsxs(DialogFrame, { title: `Summarize ${menu.direction === 'from' ? 'from' : 'up to'} here`, screenReader: axScreenReader, children: [_jsx(Text, { children: menu.direction === 'from'
                                     ? 'Messages after this point will be summarized.'
-                                    : 'Messages up to this point will be summarized.' }), _jsx(Text, { children: " " }), _jsxs(Text, { children: ["add context (optional): ", input] }), _jsx(Text, { dimColor: true, children: "Enter to summarize \u00B7 Esc to go back" })] })) : menu?.kind === 'permission-rule-input' ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, children: ["Add ", menu.behavior, " permission rule"] }), _jsx(Text, { children: "Permission rules are a tool name, optionally followed by a specifier in parentheses." }), _jsx(Text, { children: "e.g., WebFetch or Bash(ls *)" }), _jsx(Text, { children: " " }), _jsx(Box, { borderStyle: axScreenReader ? undefined : 'round', paddingX: axScreenReader ? 0 : 1, children: _jsx(Text, { ...(input ? {} : { dimColor: true }), children: input || 'Enter permission rule…' }) }), _jsx(Text, { dimColor: true, children: "Enter to submit \u00B7 Esc to cancel" })] })) : menu?.kind === 'workspace-directory-input' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Add directory to workspace" }), _jsx(Text, { children: "Praxis Code will be able to read files in this directory and make edits when auto-accept edits is on." }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Enter the path to the directory:" }), _jsx(Box, { borderStyle: axScreenReader ? undefined : 'round', paddingX: axScreenReader ? 0 : 1, children: _jsx(Text, { ...(input ? {} : { dimColor: true }), children: input || 'Directory path…' }) }), _jsx(Text, { dimColor: true, children: "Tab to complete \u00B7 Enter to add \u00B7 Esc to cancel" })] })) : menu?.kind === 'permission-delete' ? (_jsxs(DialogFrame, { title: permissionDeleteTitle(menu.rule.behavior), screenReader: axScreenReader, children: [_jsx(Text, { children: menu.rule.rule }), permissionRuleDescription(menu.rule.rule) ? (_jsx(Text, { dimColor: true, children: permissionRuleDescription(menu.rule.rule) })) : null, _jsx(Text, { dimColor: true, children: permissionScopeLabel(menu.rule.scope) }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Are you sure you want to delete this permission rule?" }), _jsx(Text, { children: " " }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 0, children: [selectionPrefix(menu.selectedIndex === 0, axScreenReader), "1. Yes"] }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 1, children: [selectionPrefix(menu.selectedIndex === 1, axScreenReader), "2. No"] }), _jsx(Text, { dimColor: true, children: "Esc to cancel" })] })) : menu?.kind === 'workspace-directory-delete' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Remove directory from workspace?" }), _jsxs(Text, { children: [" ", menu.path] }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Praxis Code will no longer have access to files in this directory." }), _jsx(Text, { children: " " }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 0, children: [selectionPrefix(menu.selectedIndex === 0, axScreenReader), "1. Yes"] }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 1, children: [selectionPrefix(menu.selectedIndex === 1, axScreenReader), "2. No"] }), _jsx(Text, { dimColor: true, children: "Enter to confirm \u00B7 Esc to cancel" })] })) : menu ? (menu.kind === 'help' ? (_jsx(HelpMenu, { tabIndex: menu.tabIndex, selectedIndex: menu.selectedIndex, builtinCommands: builtinSlashCommands, customCommands: customSlashCommands, width: width, screenReader: axScreenReader })) : menu.kind === 'diff' ? (_jsx(DiffDashboard, { snapshots: menu.snapshots, sourceIndex: menu.sourceIndex, selectedIndex: menu.selectedIndex, viewingFile: menu.viewingFile, scrollOffset: menu.scrollOffset, width: width, screenReader: axScreenReader })) : menu.kind === 'permission-dashboard' ? (_jsx(PermissionDashboard, { tabIndex: menu.tabIndex, selectedIndex: menu.selectedIndex, query: menu.query, rules: menu.rules, recentDenied: recentDenied, retryingDeniedId: retryingDeniedId, workspaceDirectories: workspaceDirectories, width: width, screenReader: axScreenReader })) : menu.kind === 'permission-scope' ? (_jsx(SelectionMenu, { title: "Where should this rule be saved?", description: `${menu.rule}${permissionRuleDescription(menu.rule)
+                                    : 'Messages up to this point will be summarized.' }), _jsx(Text, { children: " " }), _jsxs(Text, { children: ["add context (optional): ", input] }), _jsx(Text, { dimColor: true, children: "Enter to summarize \u00B7 Esc to go back" })] })) : menu?.kind === 'permission-rule-input' ? (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { bold: true, children: ["Add ", menu.behavior, " permission rule"] }), _jsx(Text, { children: "Permission rules are a tool name, optionally followed by a specifier in parentheses." }), _jsx(Text, { children: "e.g., WebFetch or Bash(ls *)" }), _jsx(Text, { children: " " }), _jsx(Box, { borderStyle: axScreenReader ? undefined : 'round', paddingX: axScreenReader ? 0 : 1, children: _jsx(Text, { ...(input ? {} : { dimColor: true }), children: input || 'Enter permission rule…' }) }), _jsx(Text, { dimColor: true, children: "Enter to submit \u00B7 Esc to cancel" })] })) : menu?.kind === 'workspace-directory-input' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Add directory to workspace" }), _jsx(Text, { children: "Praxis Code will be able to read files in this directory and make edits when auto-accept edits is on." }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Enter the path to the directory:" }), _jsx(Box, { borderStyle: axScreenReader ? undefined : 'round', paddingX: axScreenReader ? 0 : 1, children: _jsx(Text, { ...(input ? {} : { dimColor: true }), children: input || 'Directory path…' }) }), _jsx(Text, { dimColor: true, children: "Tab to complete \u00B7 Enter to add \u00B7 Esc to cancel" })] })) : menu?.kind === 'permission-delete' ? (_jsxs(DialogFrame, { title: permissionDeleteTitle(menu.rule.behavior), screenReader: axScreenReader, children: [_jsx(Text, { children: menu.rule.rule }), permissionRuleDescription(menu.rule.rule) ? (_jsx(Text, { dimColor: true, children: permissionRuleDescription(menu.rule.rule) })) : null, _jsx(Text, { dimColor: true, children: permissionScopeLabel(menu.rule.scope) }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Are you sure you want to delete this permission rule?" }), _jsx(Text, { children: " " }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 0, children: [selectionPrefix(menu.selectedIndex === 0, axScreenReader), "1. Yes"] }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 1, children: [selectionPrefix(menu.selectedIndex === 1, axScreenReader), "2. No"] }), _jsx(Text, { dimColor: true, children: "Esc to cancel" })] })) : menu?.kind === 'workspace-directory-delete' ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Remove directory from workspace?" }), _jsxs(Text, { children: [" ", menu.path] }), _jsx(Text, { children: " " }), _jsx(Text, { children: "Praxis Code will no longer have access to files in this directory." }), _jsx(Text, { children: " " }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 0, children: [selectionPrefix(menu.selectedIndex === 0, axScreenReader), "1. Yes"] }), _jsxs(Text, { inverse: !axScreenReader && menu.selectedIndex === 1, children: [selectionPrefix(menu.selectedIndex === 1, axScreenReader), "2. No"] }), _jsx(Text, { dimColor: true, children: "Enter to confirm \u00B7 Esc to cancel" })] })) : menu ? (menu.kind === 'help' ? (_jsx(HelpMenu, { tabIndex: menu.tabIndex, selectedIndex: menu.selectedIndex, builtinCommands: builtinSlashCommands, customCommands: customSlashCommands, width: width, screenReader: axScreenReader })) : menu.kind === 'diff' ? (_jsx(DiffDashboard, { snapshots: menu.snapshots, sourceIndex: menu.sourceIndex, selectedIndex: menu.selectedIndex, viewingFile: menu.viewingFile, scrollOffset: menu.scrollOffset, width: width, screenReader: axScreenReader })) : menu.kind === 'permission-dashboard' ? (_jsx(PermissionDashboard, { tabIndex: menu.tabIndex, selectedIndex: menu.selectedIndex, query: menu.query, rules: menu.rules, recentDenied: recentDenied, retryingDeniedId: retryingDeniedId, workspaceDirectories: workspaceDirectories, width: width, screenReader: axScreenReader })) : menu.kind === 'sandbox' ? (_jsx(SandboxDashboard, { snapshot: menu.snapshot, tab: menu.tab, selectedIndex: menu.selectedIndex, width: width, screenReader: axScreenReader })) : menu.kind === 'permission-scope' ? (_jsx(SelectionMenu, { title: "Where should this rule be saved?", description: `${menu.rule}${permissionRuleDescription(menu.rule)
                             ? ` · ${permissionRuleDescription(menu.rule)}`
                             : ''}`, options: [
                             {

package/dist/cli/tui/sandbox-dashboard.d.ts

@@ -0,0 +1,10 @@
+import type { TuiSandboxSnapshot, TuiSandboxTab } from './sandbox-settings.js';
+export declare function tuiSandboxTabs(snapshot: TuiSandboxSnapshot): readonly TuiSandboxTab[];
+export declare function SandboxDashboard({ snapshot, tab, selectedIndex, width, screenReader, }: {
+    snapshot: TuiSandboxSnapshot;
+    tab: TuiSandboxTab;
+    selectedIndex: number;
+    width: number;
+    screenReader: boolean;
+}): import("react").JSX.Element;
+//# sourceMappingURL=sandbox-dashboard.d.ts.map

package/dist/cli/tui/sandbox-dashboard.js

@@ -0,0 +1,78 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Box, Text } from 'ink';
+const TABS = {
+    mode: 'Mode',
+    dependencies: 'Dependencies',
+    overrides: 'Overrides',
+    config: 'Config',
+};
+export function tuiSandboxTabs(snapshot) {
+    if (snapshot.dependencies.errors.length > 0)
+        return ['dependencies'];
+    return [
+        'mode',
+        ...(snapshot.dependencies.warnings.length > 0
+            ? ['dependencies']
+            : []),
+        'overrides',
+        'config',
+    ];
+}
+function prefix(selected, screenReader) {
+    if (screenReader)
+        return selected ? 'Selected: ' : '';
+    return selected ? '❯ ' : '  ';
+}
+export function SandboxDashboard({ snapshot, tab, selectedIndex, width, screenReader, }) {
+    const tabs = tuiSandboxTabs(snapshot);
+    const mode = !snapshot.settings.enabled
+        ? 'disabled'
+        : snapshot.settings.autoAllowBashIfSandboxed
+            ? 'auto-allow'
+            : 'regular';
+    const modeRows = [
+        {
+            value: 'auto-allow',
+            label: 'Sandbox BashTool, with auto-allow',
+        },
+        {
+            value: 'regular',
+            label: 'Sandbox BashTool, with regular permissions',
+        },
+        { value: 'disabled', label: 'No Sandbox' },
+    ];
+    const overrideRows = [
+        {
+            value: true,
+            label: 'Allow unsandboxed fallback',
+        },
+        {
+            value: false,
+            label: 'Strict sandbox mode',
+        },
+    ];
+    const filesystem = snapshot.settings.runtimeConfig.filesystem;
+    const network = snapshot.settings.runtimeConfig.network;
+    return (_jsxs(Box, { flexDirection: "column", width: Math.min(100, width), children: [!screenReader ? (_jsx(Text, { dimColor: true, children: '─'.repeat(Math.min(100, width)) })) : null, _jsx(Text, { bold: true, children: " Sandbox:" }), _jsxs(Text, { children: ['  ', tabs.map((candidate) => (_jsxs(Text, { inverse: !screenReader && candidate === tab, children: [screenReader && candidate === tab ? 'Current tab: ' : ' ', TABS[candidate], ' '] }, candidate)))] }), _jsx(Text, { children: " " }), tab === 'mode' ? (_jsxs(_Fragment, { children: [_jsx(Text, { bold: true, children: " Configure Mode:" }), _jsx(Text, { children: " " }), modeRows.map((row, index) => (_jsxs(Text, { inverse: !screenReader && selectedIndex === index, children: [prefix(selectedIndex === index, screenReader), index + 1, ". ", row.label, row.value === mode ? ' (current)' : ''] }, row.value))), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Auto-allow mode runs Bash in the sandbox automatically. Explicit ask and deny rules are always respected." })] })) : tab === 'dependencies' ? (_jsxs(Box, { flexDirection: "column", children: [snapshot.platform === 'macos' ? (_jsxs(Text, { children: ["seatbelt: ", _jsx(Text, { color: "green", children: "built-in (macOS)" })] })) : (_jsxs(_Fragment, { children: [_jsxs(Text, { children: ["bubblewrap (bwrap):", ' ', _jsx(Text, { color: snapshot.dependencies.errors.some((error) => error.includes('bwrap'))
+                                            ? 'red'
+                                            : 'green', children: snapshot.dependencies.errors.some((error) => error.includes('bwrap'))
+                                            ? 'not installed'
+                                            : 'installed' })] }), _jsxs(Text, { children: ["socat:", ' ', _jsx(Text, { color: snapshot.dependencies.errors.some((error) => error.includes('socat'))
+                                            ? 'red'
+                                            : 'green', children: snapshot.dependencies.errors.some((error) => error.includes('socat'))
+                                            ? 'not installed'
+                                            : 'installed' })] }), _jsxs(Text, { children: ["seccomp filter:", ' ', _jsx(Text, { color: snapshot.dependencies.warnings.length > 0
+                                            ? 'yellow'
+                                            : 'green', children: snapshot.dependencies.warnings.length > 0
+                                            ? 'not installed'
+                                            : 'installed' })] })] })), _jsxs(Text, { children: ["ripgrep (rg):", ' ', _jsx(Text, { color: snapshot.dependencies.errors.some((error) => error.includes('ripgrep'))
+                                    ? 'red'
+                                    : 'green', children: snapshot.dependencies.errors.some((error) => error.includes('ripgrep'))
+                                    ? 'not found'
+                                    : 'found' })] }), snapshot.dependencies.errors.map((error) => (_jsx(Text, { color: "red", children: error }, error))), snapshot.dependencies.warnings.map((warning) => (_jsx(Text, { color: "yellow", children: warning }, warning))), snapshot.unavailableReason ? (_jsx(Text, { color: "red", children: snapshot.unavailableReason })) : null] })) : tab === 'overrides' ? (_jsxs(_Fragment, { children: [!snapshot.settings.enabled ? (_jsx(Text, { dimColor: true, children: "Sandbox is not enabled" })) : (overrideRows.map((row, index) => (_jsxs(Text, { inverse: !screenReader && selectedIndex === index, children: [prefix(selectedIndex === index, screenReader), index + 1, ". ", row.label, row.value === snapshot.settings.allowUnsandboxedCommands
+                                ? ' (current)'
+                                : ''] }, String(row.value))))), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: "Closed mode ignores dangerouslyDisableSandbox and requires commands to remain sandboxed." })] })) : !snapshot.settings.enabled ? (_jsx(Text, { dimColor: true, children: "Sandbox is not enabled" })) : (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { bold: true, children: "Excluded Commands:" }), _jsx(Text, { dimColor: true, children: snapshot.settings.excludedCommands.join(', ') || 'None' }), _jsx(Text, { bold: true, children: "Filesystem Read Restrictions:" }), _jsxs(Text, { dimColor: true, children: ["Denied: ", filesystem?.denyRead?.join(', ') || 'None'] }), _jsxs(Text, { dimColor: true, children: ["Allowed within denied: ", filesystem?.allowRead?.join(', ') || 'None'] }), _jsx(Text, { bold: true, children: "Filesystem Write Restrictions:" }), _jsxs(Text, { dimColor: true, children: ["Allowed: ", filesystem?.allowWrite?.join(', ') || 'None'] }), _jsxs(Text, { dimColor: true, children: ["Denied within allowed: ", filesystem?.denyWrite?.join(', ') || 'None'] }), _jsx(Text, { bold: true, children: "Network Restrictions:" }), _jsxs(Text, { dimColor: true, children: ["Allowed: ", network?.allowedDomains?.join(', ') || 'None'] }), _jsxs(Text, { dimColor: true, children: ["Denied: ", network?.deniedDomains?.join(', ') || 'None'] }), _jsx(Text, { bold: true, children: "Allowed Unix Sockets:" }), _jsx(Text, { dimColor: true, children: network?.allowUnixSockets?.join(', ') || 'None' }), (snapshot.globPatternWarnings?.length ?? 0) > 0 ? (_jsxs(_Fragment, { children: [_jsx(Text, { bold: true, color: "yellow", children: "\u26A0 Warning: Glob patterns not fully supported on Linux" }), _jsx(Text, { dimColor: true, children: snapshot.globPatternWarnings?.slice(0, 3).join(', ') })] })) : null] })), _jsx(Text, { children: " " }), _jsx(Text, { dimColor: true, children: tab === 'mode' || (tab === 'overrides' && snapshot.settings.enabled)
+                    ? '↑/↓ navigate · Enter to select · ←/→ switch tabs · Esc to cancel'
+                    : '←/→ switch tabs · Esc to cancel' })] }));
+}
+//# sourceMappingURL=sandbox-dashboard.js.map

package/dist/cli/tui/sandbox-settings.d.ts

@@ -0,0 +1,32 @@
+import type { SandboxDependencyCheck } from '@anthropic-ai/sandbox-runtime';
+import { loadClaudeSettings } from '../../compatibility/claude/shared-resources.js';
+import { type ClaudeSandboxSettings } from '../../sandbox/claude-sandbox-settings.js';
+export type TuiSandboxMode = 'auto-allow' | 'regular' | 'disabled';
+export type TuiSandboxTab = 'mode' | 'dependencies' | 'overrides' | 'config';
+export interface TuiSandboxSnapshot {
+    settings: ClaudeSandboxSettings;
+    dependencies: SandboxDependencyCheck;
+    supported: boolean;
+    platform: 'macos' | 'linux' | 'windows' | 'wsl';
+    globPatternWarnings?: readonly string[];
+    unavailableReason?: string;
+}
+export interface TuiSandboxStore {
+    load(): Promise<TuiSandboxSnapshot>;
+    setMode(mode: TuiSandboxMode): Promise<TuiSandboxSnapshot>;
+    setAllowUnsandboxedCommands(allow: boolean): Promise<TuiSandboxSnapshot>;
+    exclude(pattern: string): Promise<{
+        pattern: string;
+        settingsPath: string;
+        snapshot: TuiSandboxSnapshot;
+    }>;
+}
+export declare function linuxGlobPatternWarnings(resources: Awaited<ReturnType<typeof loadClaudeSettings>>, platform: 'macos' | 'linux' | 'windows' | 'wsl'): string[];
+export declare function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories, environment, }: {
+    configRoot: string;
+    cwd: string;
+    homeDirectory: string;
+    additionalDirectories?: readonly string[];
+    environment?: NodeJS.ProcessEnv;
+}): TuiSandboxStore;
+//# sourceMappingURL=sandbox-settings.d.ts.map

package/dist/cli/tui/sandbox-settings.js

@@ -0,0 +1,146 @@
+import { readFile } from 'node:fs/promises';
+import { join, relative } from 'node:path';
+import { loadClaudeSettings } from '../../compatibility/claude/shared-resources.js';
+import { writeFileAtomically } from '../../platform/atomic-write.js';
+import { claudeSandboxRuntime } from '../../sandbox/claude-sandbox-runtime.js';
+import { claudeSandboxTempDirectory, loadClaudeSandboxSettings, } from '../../sandbox/claude-sandbox-settings.js';
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+async function readLocalSettings(path) {
+    try {
+        const value = JSON.parse(await readFile(path, 'utf8'));
+        if (!isRecord(value))
+            throw new Error(`Settings must be an object: ${path}`);
+        return value;
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return {};
+        throw error;
+    }
+}
+async function updateLocalSandbox(path, update) {
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+        let source;
+        try {
+            source = await readFile(path, 'utf8');
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+        const settings = await readLocalSettings(path);
+        const current = settings.sandbox;
+        if (current !== undefined && !isRecord(current)) {
+            throw new Error(`sandbox must be an object: ${path}`);
+        }
+        const committed = await writeFileAtomically(path, `${JSON.stringify({ ...settings, sandbox: update(current ?? {}) }, null, 2)}\n`, {
+            beforeCommit: async () => {
+                try {
+                    return (await readFile(path, 'utf8')) === source;
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        return source === undefined;
+                    throw error;
+                }
+            },
+        });
+        if (committed)
+            return;
+    }
+    throw new Error(`Settings changed concurrently: ${path}`);
+}
+export function linuxGlobPatternWarnings(resources, platform) {
+    if (platform !== 'linux' && platform !== 'wsl')
+        return [];
+    const warnings = [];
+    for (const resource of resources) {
+        if (!isRecord(resource.value) || !isRecord(resource.value.permissions))
+            continue;
+        for (const behavior of ['allow', 'deny']) {
+            const rules = resource.value.permissions[behavior];
+            if (!Array.isArray(rules))
+                continue;
+            for (const rule of rules) {
+                if (typeof rule !== 'string')
+                    continue;
+                const match = /^(?:Edit|Read)\((.*)\)$/u.exec(rule);
+                const pattern = match?.[1]?.replace(/\/\*\*$/u, '');
+                if (pattern && /[*?[\]]/u.test(pattern))
+                    warnings.push(rule);
+            }
+        }
+    }
+    return [...new Set(warnings)];
+}
+export function createTuiSandboxStore({ configRoot, cwd, homeDirectory, additionalDirectories = [], environment = process.env, }) {
+    const localSettingsPath = join(cwd, '.claude', 'settings.local.json');
+    const load = async () => {
+        const resources = await loadClaudeSettings({ configRoot, cwd });
+        const settings = loadClaudeSandboxSettings({
+            resources,
+            cwd,
+            configRoot,
+            homeDirectory,
+            additionalDirectories,
+            tempDirectory: claudeSandboxTempDirectory(environment),
+        });
+        await claudeSandboxRuntime.initialize(settings);
+        const unavailableReason = claudeSandboxRuntime.unavailableReason(settings);
+        const platform = claudeSandboxRuntime.platformName();
+        return {
+            settings,
+            dependencies: claudeSandboxRuntime.dependencyCheck(settings),
+            supported: claudeSandboxRuntime.isSupportedPlatform(),
+            platform,
+            globPatternWarnings: linuxGlobPatternWarnings(resources, platform),
+            ...(unavailableReason ? { unavailableReason } : {}),
+        };
+    };
+    return {
+        load,
+        async setMode(mode) {
+            await updateLocalSandbox(localSettingsPath, (sandbox) => ({
+                ...sandbox,
+                enabled: mode !== 'disabled',
+                autoAllowBashIfSandboxed: mode === 'auto-allow',
+            }));
+            return load();
+        },
+        async setAllowUnsandboxedCommands(allow) {
+            await updateLocalSandbox(localSettingsPath, (sandbox) => ({
+                ...sandbox,
+                allowUnsandboxedCommands: allow,
+            }));
+            return load();
+        },
+        async exclude(pattern) {
+            const cleanPattern = pattern.trim().replace(/^["']|["']$/gu, '');
+            if (!cleanPattern) {
+                throw new Error('Please provide a command pattern to exclude');
+            }
+            await updateLocalSandbox(localSettingsPath, (sandbox) => {
+                const excluded = sandbox.excludedCommands;
+                if (excluded !== undefined &&
+                    (!Array.isArray(excluded) ||
+                        excluded.some((value) => typeof value !== 'string'))) {
+                    throw new Error(`sandbox.excludedCommands must be an array of strings: ${localSettingsPath}`);
+                }
+                return {
+                    ...sandbox,
+                    excludedCommands: [
+                        ...new Set([...(excluded ?? []), cleanPattern]),
+                    ],
+                };
+            });
+            return {
+                pattern: cleanPattern,
+                settingsPath: relative(cwd, localSettingsPath),
+                snapshot: await load(),
+            };
+        },
+    };
+}
+//# sourceMappingURL=sandbox-settings.js.map

package/dist/cli/tui/slash-commands.js

@@ -64,6 +64,11 @@ export const BUILTIN_TUI_SLASH_COMMANDS = [
         description: 'Manage allow and deny tool permission rules',
         source: 'builtin',
     },
+    {
+        name: 'sandbox',
+        description: 'Configure sandbox mode and command isolation',
+        source: 'builtin',
+    },
     {
         name: 'resume',
         description: 'Resume a previous conversation',

package/dist/cli.d.ts

@@ -114,6 +114,7 @@ export interface CliDependencies extends InteractiveServiceFactory {
         exposeToolRegistry?: boolean;
         emitToolUseSummaries?: boolean;
         cwd?: string;
+        sandboxOriginalCwd?: string;
         configRoot?: string;
         environment?: Readonly<Record<string, string>>;
         providerEnvironment?: NodeJS.ProcessEnv;

package/dist/cli.js

@@ -43,6 +43,8 @@ import { FilteredToolRegistry } from './tools/filtered-tool-registry.js';
 import { WebToolRegistry } from './tools/web.js';
 import { WorkspaceContext } from './application/session-worktree.js';
 import { launchTmuxWorktree } from './platform/tmux-worktree.js';
+import { claudeSandboxRuntime } from './sandbox/claude-sandbox-runtime.js';
+import { claudeSandboxTempDirectory, loadClaudeSandboxSettings, } from './sandbox/claude-sandbox-settings.js';
 import { createErrorResult, createSuccessResult, parseCliInvocation, readStreamJsonMessages, StreamJsonOutput, } from './cli/protocol.js';
 import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaudePlugins, readPluginRegistry, setClaudePluginEnabled, uninstallClaudePlugin, updateClaudePlugin, validateClaudePlugin, } from './plugins/claude-plugin-runtime.js';
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
@@ -688,8 +690,9 @@ const consoleIO = {
     isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     readStdinLines: () => process.stdin,
 };
-const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
+const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
     const runtimeEnvironment = requestedProviderEnvironment ?? process.env;
+    const sandboxEnvironment = { ...runtimeEnvironment, ...environment };
     const claudeVersion = await detectInstalledClaudeVersion();
     const cwd = requestedCwd ?? process.cwd();
     const workspace = new WorkspaceContext(cwd);
@@ -948,9 +951,26 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...cli.additionalDirectories,
         ...(exposePlanDirectory ? [resolve(configRoot, 'plans')] : []),
     ];
+    const sandboxSettings = loadClaudeSandboxSettings({
+        resources: settings.filter((resource) => resource.plugin !== true),
+        cwd: workspace.cwd(),
+        originalCwd: sandboxOriginalCwd ?? workspace.cwd(),
+        configRoot,
+        homeDirectory: sandboxEnvironment.HOME ?? sandboxEnvironment.USERPROFILE ?? homedir(),
+        additionalDirectories: initialAdditionalDirectories,
+        tempDirectory: claudeSandboxTempDirectory(sandboxEnvironment),
+    });
+    await claudeSandboxRuntime.initialize(sandboxSettings);
+    const sandboxUnavailableReason = claudeSandboxRuntime.unavailableReason();
+    if (sandboxUnavailableReason && !sandboxSettings.failIfUnavailable) {
+        runtimeEventSink({ type: 'warning', message: sandboxUnavailableReason });
+    }
     const permissionAdditionalDirectories = [
-        ...initialAdditionalDirectories,
-        ...(memoryDirectory ? [memoryDirectory] : []),
+        ...new Set([
+            ...initialAdditionalDirectories,
+            ...controls.addDirectories.map((directory) => resolve(cwd, directory)),
+            ...(memoryDirectory ? [memoryDirectory] : []),
+        ]),
     ];
     const initialAdditionalReadDirectories = [claudeBackgroundTaskParent(cwd)];
     const permissionResolverForMode = (permissionMode) => new ClaudeExtensionPermissionResolver(new ClaudePermissionResolver({
@@ -962,6 +982,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         disallowedTools: cli.disallowedTools,
         additionalDirectories: permissionAdditionalDirectories,
         additionalReadDirectories: initialAdditionalReadDirectories,
+        sandbox: claudeSandboxRuntime,
         permissionMode,
         ...(isSessionActionApproved ? { isSessionActionApproved } : {}),
         ...(permissionMode === 'auto'
@@ -978,6 +999,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...(memoryDirectory ? { sharedMemoryDirectory: memoryDirectory } : {}),
         additionalDirectories: initialAdditionalDirectories,
         additionalReadDirectories: initialAdditionalReadDirectories,
+        sandbox: claudeSandboxRuntime,
         ...(environment ? { environment } : {}),
     });
     const runtimeMcpResources = async (candidates) => {
@@ -1463,6 +1485,7 @@ const defaultPluginEvalRuntimeFactory = {
                 USERPROFILE: options.home,
             },
             providerEnvironment: process.env,
+            isSessionActionApproved: (call) => options.allowedTools.includes(call.name),
             controls: {
                 ...DEFAULT_CLI_CONTROLS,
                 sessionPersistence: false,
@@ -1568,6 +1591,7 @@ const defaultDependencies = {
                 createService: ({ additionalDirectories, cwd, ...options }) => createDefaultService({
                     ...options,
                     ...(cwd === undefined ? {} : { cwd }),
+                    sandboxOriginalCwd: process.cwd(),
                     ...(agent === undefined ? {} : { agent }),
                     controls: {
                         ...interactiveControls,