praxis-agent 0.11.0 → 0.13.0

package/dist/cli/tui/status-line.js

@@ -0,0 +1,234 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+import { spawn } from 'node:child_process';
+import { watchFile, unwatchFile } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { Box, Text } from 'ink';
+import { useCallback, useEffect, useRef, useState } from 'react';
+import { isClaudeSessionId, resolveClaudePaths, sanitizeClaudeProjectPath, } from '../../compatibility/claude/paths.js';
+import { loadClaudeSettings } from '../../compatibility/claude/shared-resources.js';
+import { commandShell, commandShellArguments, } from '../../platform/command-shell.js';
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+export async function loadClaudeStatusLineSetting(options) {
+    const resources = await loadClaudeSettings(options);
+    const merged = Object.assign({}, ...resources.map((resource) => record(resource.value) ?? {}));
+    const value = record(merged.statusLine);
+    const setting = value?.type === 'command' && typeof value.command === 'string'
+        ? {
+            type: 'command',
+            command: value.command,
+            ...(typeof value.padding === 'number' &&
+                Number.isFinite(value.padding)
+                ? { padding: value.padding }
+                : {}),
+        }
+        : undefined;
+    return {
+        ...(setting ? { setting } : {}),
+        disabled: merged.disableAllHooks === true,
+    };
+}
+export async function executeClaudeStatusLine(setting, input, options = {
+    cwd: process.cwd(),
+}) {
+    const timeout = AbortSignal.timeout(options.timeoutMs ?? 5000);
+    const signal = options.signal
+        ? AbortSignal.any([options.signal, timeout])
+        : timeout;
+    return new Promise((resolve) => {
+        let settled = false;
+        let stdout = '';
+        const finish = (value) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(value);
+        };
+        let child;
+        try {
+            child = spawn(commandShell(), commandShellArguments(setting.command), {
+                cwd: options.cwd,
+                detached: process.platform !== 'win32',
+                env: process.env,
+                stdio: ['pipe', 'pipe', 'ignore'],
+            });
+        }
+        catch {
+            finish();
+            return;
+        }
+        child.stdout.setEncoding('utf8');
+        const terminate = () => {
+            if (child.pid === undefined)
+                return;
+            try {
+                if (process.platform === 'win32')
+                    child.kill('SIGKILL');
+                else
+                    process.kill(-child.pid, 'SIGKILL');
+            }
+            catch (error) {
+                if (error.code !== 'ESRCH')
+                    finish();
+            }
+        };
+        if (signal.aborted)
+            terminate();
+        else
+            signal.addEventListener('abort', terminate, { once: true });
+        child.stdout.on('data', (chunk) => {
+            if (stdout.length <= 1024 * 1024)
+                stdout += chunk;
+        });
+        child.on('error', () => {
+            signal.removeEventListener('abort', terminate);
+            finish();
+        });
+        child.on('close', (code) => {
+            signal.removeEventListener('abort', terminate);
+            if (code !== 0 || signal.aborted) {
+                finish();
+                return;
+            }
+            const output = stdout
+                .trim()
+                .split(/\r?\n/u)
+                .map((line) => line.trim())
+                .filter(Boolean)
+                .join('\n');
+            finish(output || undefined);
+        });
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(JSON.stringify(input));
+    });
+}
+export function createClaudeStatusLineInput(options) {
+    const usage = options.usage;
+    const contextInputTokens = usage
+        ? usage.inputTokens +
+            (usage.cacheReadInputTokens ?? 0) +
+            (usage.cacheCreationInputTokens ?? 0)
+        : null;
+    const usedTokens = contextInputTokens === null || usage === undefined
+        ? null
+        : contextInputTokens + usage.outputTokens;
+    const contextWindowSize = options.contextWindowTokens ?? 0;
+    const usedPercentage = contextInputTokens === null || contextWindowSize <= 0
+        ? null
+        : Math.min(100, Math.max(0, Math.round((contextInputTokens / contextWindowSize) * 100)));
+    const model = options.model ?? 'default';
+    const transcriptPath = isClaudeSessionId(options.sessionId)
+        ? resolveClaudePaths({
+            configDir: options.configRoot,
+            cwd: options.cwd,
+            sessionId: options.sessionId,
+        }).sessionFile
+        : resolve(options.configRoot, 'projects', sanitizeClaudeProjectPath(options.cwd), `${options.sessionId}.jsonl`);
+    return {
+        session_id: options.sessionId,
+        ...(options.sessionName ? { session_name: options.sessionName } : {}),
+        transcript_path: transcriptPath,
+        cwd: options.cwd,
+        ...(options.permissionMode
+            ? { permission_mode: options.permissionMode }
+            : {}),
+        model: { id: model, display_name: model },
+        workspace: {
+            current_dir: options.cwd,
+            project_dir: options.projectDir,
+            added_dirs: options.additionalDirectories,
+        },
+        version: options.version,
+        output_style: { name: options.outputStyle },
+        cost: {
+            total_cost_usd: options.costUsd ?? 0,
+            total_duration_ms: 0,
+            total_api_duration_ms: 0,
+            total_lines_added: 0,
+            total_lines_removed: 0,
+        },
+        context_window: {
+            total_input_tokens: usage?.inputTokens ?? 0,
+            total_output_tokens: usage?.outputTokens ?? 0,
+            context_window_size: contextWindowSize,
+            current_usage: usage
+                ? {
+                    input_tokens: usage.inputTokens,
+                    output_tokens: usage.outputTokens,
+                    cache_creation_input_tokens: usage.cacheCreationInputTokens ?? 0,
+                    cache_read_input_tokens: usage.cacheReadInputTokens ?? 0,
+                }
+                : null,
+            used_percentage: usedPercentage,
+            remaining_percentage: usedPercentage === null ? null : 100 - usedPercentage,
+        },
+        exceeds_200k_tokens: usedTokens !== null && usedTokens > 200_000,
+        ...(options.vimMode ? { vim: { mode: options.vimMode } } : {}),
+    };
+}
+export function StatusLine({ configRoot, cwd, input, refreshKey, settingSources, }) {
+    const [text, setText] = useState();
+    const [padding, setPadding] = useState(0);
+    const timer = useRef(undefined);
+    const controller = useRef(undefined);
+    const latestInput = useRef(input);
+    latestInput.current = input;
+    const update = useCallback(async () => {
+        controller.current?.abort();
+        const current = new AbortController();
+        controller.current = current;
+        try {
+            const loaded = await loadClaudeStatusLineSetting({
+                configRoot,
+                cwd,
+                ...(settingSources === undefined ? {} : { settingSources }),
+            });
+            if (current.signal.aborted)
+                return;
+            setPadding(loaded.setting?.padding ?? 0);
+            if (loaded.disabled || !loaded.setting) {
+                setText(undefined);
+                return;
+            }
+            const result = await executeClaudeStatusLine(loaded.setting, latestInput.current, { cwd, signal: current.signal });
+            if (!current.signal.aborted)
+                setText(result);
+        }
+        catch {
+            if (!current.signal.aborted)
+                setText(undefined);
+        }
+    }, [configRoot, cwd, settingSources]);
+    const schedule = useCallback(() => {
+        if (timer.current)
+            clearTimeout(timer.current);
+        timer.current = setTimeout(() => void update(), 300);
+    }, [update]);
+    useEffect(() => {
+        schedule();
+    }, [refreshKey, schedule]);
+    useEffect(() => {
+        const paths = [
+            join(configRoot, 'settings.json'),
+            join(cwd, '.claude', 'settings.json'),
+            join(cwd, '.claude', 'settings.local.json'),
+        ];
+        const changed = () => schedule();
+        for (const path of paths)
+            watchFile(path, { interval: 500 }, changed);
+        return () => {
+            for (const path of paths)
+                unwatchFile(path, changed);
+            controller.current?.abort();
+            if (timer.current)
+                clearTimeout(timer.current);
+        };
+    }, [configRoot, cwd, schedule]);
+    if (!text)
+        return null;
+    return (_jsx(Box, { paddingX: padding, children: _jsx(Text, { dimColor: true, wrap: "truncate", children: text }) }));
+}
+//# sourceMappingURL=status-line.js.map

package/dist/cli.d.ts

@@ -96,6 +96,7 @@ interface TopLevelAgentCommands {
     attach(id: string, input: AsyncIterable<string | Uint8Array>, output: (text: string) => void, signal?: AbortSignal): Promise<void>;
 }
 export interface CliDependencies extends InteractiveServiceFactory {
+    loadReleaseNotes?(configRoot: string): Promise<string>;
     createService(options: {
         eventSink: RuntimeEventSink;
         requireProvider: boolean;
@@ -114,6 +115,7 @@ export interface CliDependencies extends InteractiveServiceFactory {
         exposeToolRegistry?: boolean;
         emitToolUseSummaries?: boolean;
         cwd?: string;
+        sandboxOriginalCwd?: string;
         configRoot?: string;
         environment?: Readonly<Record<string, string>>;
         providerEnvironment?: NodeJS.ProcessEnv;

package/dist/cli.js

@@ -14,6 +14,7 @@ import { isClaudeSessionId, resolveClaudePaths, } from './compatibility/claude/p
 import { loadClaudeContextResources, loadClaudeSettings, loadClaudeSharedResources, resolveClaudeProjectMemoryDirectory, } from './compatibility/claude/shared-resources.js';
 import { AgentRunCancelledError, } from './core/runtime.js';
 import { persistTuiPermissionUpdates } from './cli/tui/permission-settings.js';
+import { loadClaudeReleaseNotes } from './cli/tui/release-notes.js';
 import { projectTuiHooks, } from './cli/tui/hook-settings.js';
 import { DEFAULT_CLI_CONTROLS, resolveCliControls } from './cli/controls.js';
 import { applyRuntimeSettingDefaults, loadRuntimeSettings, runtimeSettingsSystemPrompt, } from './cli/tui/runtime-settings.js';
@@ -43,6 +44,8 @@ import { FilteredToolRegistry } from './tools/filtered-tool-registry.js';
 import { WebToolRegistry } from './tools/web.js';
 import { WorkspaceContext } from './application/session-worktree.js';
 import { launchTmuxWorktree } from './platform/tmux-worktree.js';
+import { claudeSandboxRuntime } from './sandbox/claude-sandbox-runtime.js';
+import { claudeSandboxTempDirectory, loadClaudeSandboxSettings, } from './sandbox/claude-sandbox-settings.js';
 import { createErrorResult, createSuccessResult, parseCliInvocation, readStreamJsonMessages, StreamJsonOutput, } from './cli/protocol.js';
 import { describeClaudePlugin, initClaudePlugin, installClaudePlugin, loadClaudePlugins, readPluginRegistry, setClaudePluginEnabled, uninstallClaudePlugin, updateClaudePlugin, validateClaudePlugin, } from './plugins/claude-plugin-runtime.js';
 import { addClaudeMarketplace, disableAllNativePlugins, installClaudeMarketplacePlugin, listClaudeMarketplaceAvailablePlugins, listNativePluginRecords, readClaudeKnownMarketplaces, removeClaudeMarketplace, setNativePluginEnabled, saveClaudePluginConfig, uninstallNativePlugin, updateClaudeMarketplace, updateNativePlugin, validateClaudeMarketplace, } from './plugins/claude-plugin-marketplace.js';
@@ -688,8 +691,9 @@ const consoleIO = {
     isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
     readStdinLines: () => process.stdin,
 };
-const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
+const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = false, approveRecovery, approveTool, agent, model: interactiveModel, effort: interactiveEffort, permissionMode: interactivePermissionMode, isSessionActionApproved, controls = DEFAULT_CLI_CONTROLS, interactive = false, sessionKind, signal, exposeToolRegistry = false, onElicitation, askUser, approvePlan, emitToolUseSummaries = false, cwd: requestedCwd, sandboxOriginalCwd, configRoot: requestedConfigRoot, environment, providerEnvironment: requestedProviderEnvironment, }) => {
     const runtimeEnvironment = requestedProviderEnvironment ?? process.env;
+    const sandboxEnvironment = { ...runtimeEnvironment, ...environment };
     const claudeVersion = await detectInstalledClaudeVersion();
     const cwd = requestedCwd ?? process.cwd();
     const workspace = new WorkspaceContext(cwd);
@@ -948,9 +952,26 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...cli.additionalDirectories,
         ...(exposePlanDirectory ? [resolve(configRoot, 'plans')] : []),
     ];
+    const sandboxSettings = loadClaudeSandboxSettings({
+        resources: settings.filter((resource) => resource.plugin !== true),
+        cwd: workspace.cwd(),
+        originalCwd: sandboxOriginalCwd ?? workspace.cwd(),
+        configRoot,
+        homeDirectory: sandboxEnvironment.HOME ?? sandboxEnvironment.USERPROFILE ?? homedir(),
+        additionalDirectories: initialAdditionalDirectories,
+        tempDirectory: claudeSandboxTempDirectory(sandboxEnvironment),
+    });
+    await claudeSandboxRuntime.initialize(sandboxSettings);
+    const sandboxUnavailableReason = claudeSandboxRuntime.unavailableReason();
+    if (sandboxUnavailableReason && !sandboxSettings.failIfUnavailable) {
+        runtimeEventSink({ type: 'warning', message: sandboxUnavailableReason });
+    }
     const permissionAdditionalDirectories = [
-        ...initialAdditionalDirectories,
-        ...(memoryDirectory ? [memoryDirectory] : []),
+        ...new Set([
+            ...initialAdditionalDirectories,
+            ...controls.addDirectories.map((directory) => resolve(cwd, directory)),
+            ...(memoryDirectory ? [memoryDirectory] : []),
+        ]),
     ];
     const initialAdditionalReadDirectories = [claudeBackgroundTaskParent(cwd)];
     const permissionResolverForMode = (permissionMode) => new ClaudeExtensionPermissionResolver(new ClaudePermissionResolver({
@@ -962,6 +983,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         disallowedTools: cli.disallowedTools,
         additionalDirectories: permissionAdditionalDirectories,
         additionalReadDirectories: initialAdditionalReadDirectories,
+        sandbox: claudeSandboxRuntime,
         permissionMode,
         ...(isSessionActionApproved ? { isSessionActionApproved } : {}),
         ...(permissionMode === 'auto'
@@ -978,6 +1000,7 @@ const createDefaultService = async ({ eventSink, requireProvider, hooksOnly = fa
         ...(memoryDirectory ? { sharedMemoryDirectory: memoryDirectory } : {}),
         additionalDirectories: initialAdditionalDirectories,
         additionalReadDirectories: initialAdditionalReadDirectories,
+        sandbox: claudeSandboxRuntime,
         ...(environment ? { environment } : {}),
     });
     const runtimeMcpResources = async (candidates) => {
@@ -1463,6 +1486,7 @@ const defaultPluginEvalRuntimeFactory = {
                 USERPROFILE: options.home,
             },
             providerEnvironment: process.env,
+            isSessionActionApproved: (call) => options.allowedTools.includes(call.name),
             controls: {
                 ...DEFAULT_CLI_CONTROLS,
                 sessionPersistence: false,
@@ -1568,6 +1592,7 @@ const defaultDependencies = {
                 createService: ({ additionalDirectories, cwd, ...options }) => createDefaultService({
                     ...options,
                     ...(cwd === undefined ? {} : { cwd }),
+                    sandboxOriginalCwd: process.cwd(),
                     ...(agent === undefined ? {} : { agent }),
                     controls: {
                         ...interactiveControls,
@@ -1585,6 +1610,9 @@ const defaultDependencies = {
                 ? { allowDangerouslySkipPermissions: true }
                 : {}),
             additionalDirectories: initialAdditionalDirectories,
+            ...(interactiveControls.settingSources === undefined
+                ? {}
+                : { settingSources: interactiveControls.settingSources }),
             display: {
                 version: VERSION,
                 cwd: process.cwd(),
@@ -3832,6 +3860,48 @@ async function execute(argv, io, dependencies, signal) {
                 : {}),
         };
     };
+    const headlessPromptArgs = command === 'resume' ? args.slice(2) : knownCommand ? args.slice(1) : args;
+    const headlessPrompt = inputFormat === 'text' && headlessPromptArgs.length > 0
+        ? promptFrom(headlessPromptArgs)
+        : undefined;
+    if (headlessPrompt === '/release-notes' && !invocation.disableSlashCommands) {
+        const startedAt = Date.now();
+        const sessionId = invocation.sessionId ?? randomUUID();
+        const configRoot = resolve(process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), '.claude'));
+        const text = dependencies.loadReleaseNotes
+            ? await dependencies.loadReleaseNotes(configRoot)
+            : await loadClaudeReleaseNotes({ configRoot });
+        const result = {
+            sessionId,
+            text,
+            usage: { inputTokens: 0, outputTokens: 0 },
+        };
+        const info = {
+            cwd: process.cwd(),
+            model: invocation.model ?? process.env.PRAXIS_MODEL ?? 'unknown',
+            tools: [],
+            mcpServers: [],
+            permissionMode: invocation.permissionMode,
+            slashCommands: ['release-notes'],
+            agents: [],
+            skills: [],
+            claudeCodeVersion: '2.1.208',
+        };
+        if (outputFormat === 'stream-json') {
+            const output = new StreamJsonOutput((value) => writeJson(io, value), info, sessionId, includePartialMessages, invocation.includeHookEvents);
+            output.init();
+            output.sink({ type: 'text-delta', delta: text });
+            output.sink({ type: 'usage', usage: result.usage });
+            output.result(result, startedAt);
+        }
+        else if (outputFormat === 'json' || invocation.legacyJson) {
+            writeJson(io, createSuccessResult(result, info, startedAt, 0));
+        }
+        else {
+            io.stdout(`${text}\n`);
+        }
+        return 0;
+    }
     const service = await dependencies.createService({
         eventSink: outputFormat === 'stream-json' && !invocation.legacyJson
             ? (event) => {

package/dist/extensions/claude-extensions.d.ts

@@ -28,6 +28,7 @@ export interface ClaudePromptExpansionMessage {
     contentBlocks?: readonly ModelContentBlock[];
     images?: readonly ModelImage[];
 }
+export declare const BUILTIN_STATUSLINE_AGENT_PATH = "/__praxis_builtin__/agents/statusline-setup.md";
 export declare function validateClaudeExtensions(resources: readonly ClaudeTextResource[]): void;
 export declare class ClaudeExtensionCatalog {
     private readonly commands;

package/dist/extensions/claude-extensions.js

@@ -34,6 +34,49 @@ Call CronCreate with the derived cron, the parsed prompt verbatim, and recurring
 Input:
 $ARGUMENTS`,
 };
+const BUILTIN_STATUSLINE_COMMAND = {
+    path: '/__praxis_builtin__/commands/statusline.md',
+    scope: 'user',
+    content: '',
+    kind: 'command',
+    name: 'statusline',
+    description: "Set up Claude Code's status line UI",
+    modelInvocable: true,
+    permissionSafe: true,
+    body: `Create an Agent with subagent_type "statusline-setup" and the prompt "$ARGUMENTS"`,
+};
+export const BUILTIN_STATUSLINE_AGENT_PATH = '/__praxis_builtin__/agents/statusline-setup.md';
+const BUILTIN_STATUSLINE_AGENT = {
+    path: BUILTIN_STATUSLINE_AGENT_PATH,
+    scope: 'user',
+    content: '',
+    kind: 'agent',
+    name: 'statusline-setup',
+    description: "Configure the user's Claude Code status line setting.",
+    modelInvocable: false,
+    permissionSafe: false,
+    body: `You configure the statusLine command in the user's shared Claude Code settings.
+
+Importing a shell prompt:
+1. Inspect shell configuration in this order: ~/.zshrc, ~/.bashrc, ~/.bash_profile, then ~/.profile.
+2. Find an exported or unexported quoted PS1 assignment. Preserve the prompt's information and colors.
+3. Translate prompt escapes into commands: user to $(whoami), short/full host to $(hostname -s)/$(hostname), working directory to $(pwd), basename to $(basename "$(pwd)"), and time/date escapes to the corresponding date command. Preserve newlines and literal prompt counters.
+4. Emit ANSI sequences with printf because the result is rendered by a terminal in dimmed colors.
+5. Remove a trailing prompt marker such as "$" or ">" from the displayed status line.
+6. If no PS1 exists and the request gives no other design, ask what information should be displayed.
+
+The status command receives one JSON document on stdin. It contains session_id, optional session_name, transcript_path, cwd, model.id and model.display_name, workspace.current_dir/project_dir/added_dirs, version, output_style.name, cost totals, context_window totals/current_usage/used_percentage/remaining_percentage, exceeds_200k_tokens, and optional vim, agent, and worktree objects. Read stdin once and reuse it when extracting multiple values. Typical jq selectors include .model.display_name, .workspace.current_dir, .output_style.name, .context_window.remaining_percentage, and .context_window.used_percentage. Optional values must be tested before printing them.
+
+Preserve every unrelated setting and update ~/.claude/settings.json with this shape:
+{
+  "statusLine": {
+    "type": "command",
+    "command": "the command"
+  }
+}
+
+Resolve a symlinked settings file and edit its target. Complex implementations may live in a script under ~/.claude and be referenced by the setting. Git commands in that script must avoid optional locks. Report the exact configuration and script path, if any. End by telling the parent agent that future status-line changes must use the statusline-setup agent and that the user can request further changes.`,
+};
 const GENERAL_PURPOSE_AGENT = {
     name: 'general-purpose',
     description: 'General-purpose agent for researching complex questions, searching for code, and executing multi-step tasks.',
@@ -175,7 +218,10 @@ export class ClaudeExtensionCatalog {
         this.disableSlashCommands = options.disableSlashCommands === true;
         this.commands = options.disableSlashCommands
             ? new Map()
-            : new Map([['loop', BUILTIN_LOOP]]);
+            : new Map([
+                ['loop', BUILTIN_LOOP],
+                ['statusline', BUILTIN_STATUSLINE_COMMAND],
+            ]);
         if (!options.disableSlashCommands) {
             for (const [name, command] of indexed('command', resources.commands)) {
                 this.commands.set(name, command);
@@ -184,7 +230,10 @@ export class ClaudeExtensionCatalog {
         this.skills = options.disableSlashCommands
             ? new Map()
             : indexed('skill', resources.skills);
-        this.agents = indexed('agent', resources.agents);
+        this.agents = new Map([
+            ['statusline-setup', BUILTIN_STATUSLINE_AGENT],
+            ...indexed('agent', resources.agents),
+        ]);
     }
     setMcpPrompts(prompts) {
         this.mcpPrompts.clear();
@@ -208,6 +257,9 @@ export class ClaudeExtensionCatalog {
         if (!definition) {
             return { userMessages: [prompt] };
         }
+        const invocationArguments = definition === BUILTIN_STATUSLINE_COMMAND && argumentsText.length === 0
+            ? 'Configure my statusLine from my shell PS1 configuration'
+            : argumentsText;
         return {
             userMessages: [
                 [
@@ -217,7 +269,7 @@ export class ClaudeExtensionCatalog {
                         ? [`<command-args>${argumentsText}</command-args>`]
                         : []),
                 ].join('\n'),
-                renderInvocation(definition, argumentsText),
+                renderInvocation(definition, invocationArguments),
             ],
         };
     }

package/dist/permissions/bash-path-safety.d.ts

@@ -1,3 +1,4 @@
+import type { FsWriteRestrictionConfig } from '@anthropic-ai/sandbox-runtime';
 import type { PermissionUpdate } from '../core/runtime.js';
 type FileOperation = 'read' | 'write' | 'create';
 type RuleOutcome = 'allow' | 'deny' | null;
@@ -8,6 +9,7 @@ export interface BashPathSafetyOptions {
     writeRoots: readonly string[];
     internalEditableRoots?: readonly string[];
     internalReadableRoots?: readonly string[];
+    sandboxWriteConfig?: FsWriteRestrictionConfig;
     permissionMode: 'acceptEdits' | 'auto' | 'bypassPermissions' | 'manual' | 'dontAsk' | 'plan' | 'default';
     fileRule?: (operation: FileOperation, absolutePath: string) => RuleOutcome;
     platform?: NodeJS.Platform;

package/dist/permissions/bash-path-safety.js

@@ -477,6 +477,13 @@ function pathFailure(rawPath, operation, options, dangerous = false) {
         pathIsInsideRoots(absolutePath, options.internalReadableRoots ?? [])) {
         return { safe: true };
     }
+    if (operation !== 'read' &&
+        !inRoot &&
+        options.sandboxWriteConfig &&
+        !pathIsInsideRoots(absolutePath, options.sandboxWriteConfig.denyWithinAllow) &&
+        pathIsInsideRoots(absolutePath, options.sandboxWriteConfig.allowOnly)) {
+        return { safe: true };
+    }
     if (rules.length > 0 && rules.every((rule) => rule === 'allow')) {
         return { safe: true };
     }

package/dist/permissions/claude-permission-resolver.d.ts

@@ -1,3 +1,4 @@
+import type { FsWriteRestrictionConfig } from '@anthropic-ai/sandbox-runtime';
 import type { ClaudeJsonResource } from '../compatibility/claude/shared-resources.js';
 import type { ModelToolCall, PermissionDecision, PermissionResolutionContext, PermissionResolver } from '../core/runtime.js';
 import { type ClaudeAutoClassifier, type ClaudeAutoModeConfig } from './claude-auto-classifier.js';
@@ -15,6 +16,15 @@ export interface ClaudePermissionResolverOptions {
     isSessionActionApproved?: (call: ModelToolCall) => boolean;
     additionalDirectories?: readonly string[];
     additionalReadDirectories?: readonly string[];
+    sandbox?: ClaudePermissionSandbox;
+}
+export interface ClaudePermissionSandbox {
+    autoAllowsBash(): boolean;
+    shouldUseSandbox(input: {
+        command: string;
+        dangerouslyDisableSandbox?: boolean;
+    }): boolean;
+    getFsWriteConfig(): FsWriteRestrictionConfig | undefined;
 }
 export type ClaudePermissionMode = 'acceptEdits' | 'auto' | 'bypassPermissions' | 'manual' | 'dontAsk' | 'plan' | 'default';
 export declare function claudePermissionActionKey(call: ModelToolCall): string;
@@ -32,6 +42,7 @@ export declare class ClaudePermissionResolver implements PermissionResolver {
     private readonly isSessionActionApproved;
     private readonly additionalDirectories;
     private readonly additionalReadDirectories;
+    private readonly sandbox;
     constructor(options: ClaudePermissionResolverOptions);
     resolve(call: ModelToolCall, context?: PermissionResolutionContext): Promise<PermissionDecision>;
     private askDecision;

package/dist/permissions/claude-permission-resolver.js

@@ -317,6 +317,7 @@ export class ClaudePermissionResolver {
     isSessionActionApproved;
     additionalDirectories;
     additionalReadDirectories;
+    sandbox;
     constructor(options) {
         this.cwd = resolve(options.cwd);
         this.cwdProvider = options.cwdProvider;
@@ -336,6 +337,7 @@ export class ClaudePermissionResolver {
         this.isSessionActionApproved = options.isSessionActionApproved;
         this.additionalDirectories = (options.additionalDirectories ?? []).map((directory) => resolve(directory));
         this.additionalReadDirectories = (options.additionalReadDirectories ?? []).map((directory) => resolve(directory));
+        this.sandbox = options.sandbox;
         if (this.permissionMode === 'auto') {
             if (!this.autoClassifier) {
                 throw new Error('Permission mode auto requires a classifier');
@@ -444,7 +446,19 @@ export class ClaudePermissionResolver {
                 .find((rule) => rule !== undefined);
         if (asked)
             return this.askDecision(call, cwd, permissionMode, context, 'rule', undefined, true);
+        if (command &&
+            call.name === 'Bash' &&
+            this.sandbox?.autoAllowsBash() &&
+            this.sandbox.shouldUseSandbox({
+                command,
+                ...(call.input.dangerouslyDisableSandbox === true
+                    ? { dangerouslyDisableSandbox: true }
+                    : {}),
+            })) {
+            return annotatePermissionDecision({ behavior: 'allow' }, 'default');
+        }
         if (command && call.name === 'Bash') {
+            const sandboxWriteConfig = this.sandbox?.getFsWriteConfig();
             const writeRoots = [
                 cwd,
                 ...effectiveAdditionalDirectories(updates, this.additionalDirectories).map((directory) => resolve(cwd, directory)),
@@ -458,6 +472,7 @@ export class ClaudePermissionResolver {
                     readRoots: [...writeRoots, ...this.additionalReadDirectories],
                     internalEditableRoots,
                     internalReadableRoots,
+                    ...(sandboxWriteConfig ? { sandboxWriteConfig } : {}),
                     permissionMode,
                     fileRule: (operation, absolutePath) => {
                         const candidate = {

package/dist/sandbox/claude-sandbox-runtime.d.ts

@@ -0,0 +1,54 @@
+import { type FsWriteRestrictionConfig, type SandboxDependencyCheck, type SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import type { ClaudeSandboxSettings } from './claude-sandbox-settings.js';
+export type ClaudeSandboxPlatform = 'macos' | 'linux' | 'windows' | 'wsl';
+export interface SandboxBackend {
+    initialize(config: SandboxRuntimeConfig): Promise<void>;
+    isSupportedPlatform(): boolean;
+    checkDependencies(ripgrep?: {
+        command: string;
+        args?: string[];
+    }): SandboxDependencyCheck;
+    wrapWithSandbox(command: string, shell?: string, config?: Partial<SandboxRuntimeConfig>, signal?: AbortSignal, options?: {
+        commandId?: string;
+        commandText?: string;
+    }): Promise<string>;
+    getFsWriteConfig(): FsWriteRestrictionConfig;
+    updateConfig(config: SandboxRuntimeConfig): void;
+    cleanupAfterCommand(): void;
+    annotateStderrWithSandboxFailures(commandId: string, stderr: string): string;
+    reset(): Promise<void>;
+}
+export interface SandboxCommandInput {
+    command: string;
+    dangerouslyDisableSandbox?: boolean;
+}
+export declare class ClaudeSandboxRuntime {
+    private readonly backend;
+    private readonly platform;
+    private active;
+    private initialized;
+    private initializationError;
+    private settings;
+    constructor(backend?: SandboxBackend, platform?: () => ClaudeSandboxPlatform);
+    initialize(settings: ClaudeSandboxSettings): Promise<void>;
+    isActive(): boolean;
+    isEnabledInSettings(): boolean;
+    isSupportedPlatform(): boolean;
+    platformName(): ClaudeSandboxPlatform;
+    dependencyCheck(settings?: ClaudeSandboxSettings): SandboxDependencyCheck;
+    autoAllowsBash(): boolean;
+    unavailableReason(settings?: ClaudeSandboxSettings): string | undefined;
+    shouldUseSandbox(input: SandboxCommandInput): boolean;
+    wrapCommand(input: SandboxCommandInput, options?: {
+        shell?: string;
+        signal?: AbortSignal;
+        commandId?: string;
+    }): Promise<string>;
+    annotateStderr(commandId: string, stderr: string): string;
+    cleanupAfterCommand(): void;
+    getFsWriteConfig(): FsWriteRestrictionConfig | undefined;
+    reset(): Promise<void>;
+    private requireSettings;
+}
+export declare const claudeSandboxRuntime: ClaudeSandboxRuntime;
+//# sourceMappingURL=claude-sandbox-runtime.d.ts.map