praxis-agent 0.11.0 → 0.13.0

package/dist/sandbox/claude-sandbox-runtime.js

@@ -0,0 +1,175 @@
+import { SandboxManager as BaseSandboxManager, } from '@anthropic-ai/sandbox-runtime';
+import { rmSync } from 'node:fs';
+import { shellPermissionMatchCandidates } from '../permissions/bash-normalization.js';
+import { shellSubcommands } from '../permissions/permission-updates.js';
+import { parseShellRule, shellRuleMatches, } from '../permissions/shell-rule-matching.js';
+function currentPlatform() {
+    if (process.platform === 'darwin')
+        return 'macos';
+    if (process.platform === 'win32')
+        return 'windows';
+    if (process.platform === 'linux' &&
+        (process.env.WSL_DISTRO_NAME !== undefined ||
+            process.env.WSL_INTEROP !== undefined)) {
+        return 'wsl';
+    }
+    return 'linux';
+}
+function matchesExcludedCommand(command, patterns) {
+    if (patterns.length === 0)
+        return false;
+    let subcommands;
+    try {
+        subcommands = shellSubcommands(command);
+    }
+    catch {
+        subcommands = [command];
+    }
+    if (subcommands.length === 0)
+        subcommands = [command];
+    return subcommands.some((subcommand) => shellPermissionMatchCandidates(subcommand, true).some((candidate) => patterns.some((pattern) => shellRuleMatches(parseShellRule(pattern), candidate))));
+}
+export class ClaudeSandboxRuntime {
+    backend;
+    platform;
+    active = false;
+    initialized = false;
+    initializationError;
+    settings;
+    constructor(backend = BaseSandboxManager, platform = currentPlatform) {
+        this.backend = backend;
+        this.platform = platform;
+    }
+    async initialize(settings) {
+        this.initializationError = undefined;
+        if (this.initialized && this.active) {
+            this.settings = settings;
+            const unavailableReason = this.unavailableReason(settings);
+            if (!settings.enabled || unavailableReason) {
+                await this.backend.reset();
+                this.active = false;
+                if (unavailableReason && settings.failIfUnavailable) {
+                    throw new Error(unavailableReason);
+                }
+                return;
+            }
+            this.backend.updateConfig(settings.runtimeConfig);
+            return;
+        }
+        this.settings = settings;
+        this.active = false;
+        this.initialized = true;
+        if (!settings.enabled)
+            return;
+        const unavailableReason = this.unavailableReason(settings);
+        if (unavailableReason) {
+            if (settings.failIfUnavailable)
+                throw new Error(unavailableReason);
+            return;
+        }
+        try {
+            await this.backend.initialize(settings.runtimeConfig);
+            this.active = true;
+        }
+        catch (error) {
+            this.initializationError =
+                error instanceof Error ? error.message : String(error);
+            if (settings.failIfUnavailable)
+                throw error;
+        }
+    }
+    isActive() {
+        return this.active;
+    }
+    isEnabledInSettings() {
+        return this.settings?.enabled ?? false;
+    }
+    isSupportedPlatform() {
+        return this.backend.isSupportedPlatform();
+    }
+    platformName() {
+        return this.platform();
+    }
+    dependencyCheck(settings = this.requireSettings()) {
+        const configuredRipgrep = settings.runtimeConfig.ripgrep;
+        return this.backend.checkDependencies(configuredRipgrep
+            ? {
+                command: configuredRipgrep.command,
+                ...(configuredRipgrep.args ? { args: configuredRipgrep.args } : {}),
+            }
+            : undefined);
+    }
+    autoAllowsBash() {
+        return this.active && (this.settings?.autoAllowBashIfSandboxed ?? true);
+    }
+    unavailableReason(settings = this.requireSettings()) {
+        if (!settings.enabled)
+            return undefined;
+        if (!this.backend.isSupportedPlatform()) {
+            return `sandbox.enabled is set but ${this.platform()} is not supported`;
+        }
+        if (settings.enabledPlatforms !== undefined &&
+            !settings.enabledPlatforms.includes(this.platform())) {
+            return `sandbox.enabled is set but ${this.platform()} is not in sandbox.enabledPlatforms`;
+        }
+        const dependencies = this.dependencyCheck(settings);
+        if (dependencies.errors.length > 0) {
+            return `sandbox.enabled is set but dependencies are missing: ${dependencies.errors.join(', ')}`;
+        }
+        if (this.initializationError) {
+            return `sandbox.enabled is set but initialization failed: ${this.initializationError}`;
+        }
+        return undefined;
+    }
+    shouldUseSandbox(input) {
+        if (!this.active)
+            return false;
+        const settings = this.requireSettings();
+        if (input.dangerouslyDisableSandbox === true &&
+            settings.allowUnsandboxedCommands) {
+            return false;
+        }
+        return !matchesExcludedCommand(input.command, settings.excludedCommands);
+    }
+    async wrapCommand(input, options = {}) {
+        if (!this.initialized)
+            throw new Error('Sandbox has not been initialized');
+        if (!this.shouldUseSandbox(input))
+            return input.command;
+        return this.backend.wrapWithSandbox(input.command, options.shell, undefined, options.signal, {
+            ...(options.commandId ? { commandId: options.commandId } : {}),
+            commandText: input.command,
+        });
+    }
+    annotateStderr(commandId, stderr) {
+        return this.backend.annotateStderrWithSandboxFailures(commandId, stderr);
+    }
+    cleanupAfterCommand() {
+        this.backend.cleanupAfterCommand();
+        for (const path of this.settings?.bareGitRepoScrubPaths ?? []) {
+            try {
+                rmSync(path, { recursive: true });
+            }
+            catch {
+                // Missing or concurrently protected paths are best-effort cleanup.
+            }
+        }
+    }
+    getFsWriteConfig() {
+        return this.active ? this.backend.getFsWriteConfig() : undefined;
+    }
+    async reset() {
+        this.active = false;
+        this.initialized = false;
+        this.initializationError = undefined;
+        this.settings = undefined;
+        await this.backend.reset();
+    }
+    requireSettings() {
+        if (!this.settings)
+            throw new Error('Sandbox has not been initialized');
+        return this.settings;
+    }
+}
+export const claudeSandboxRuntime = new ClaudeSandboxRuntime();
+//# sourceMappingURL=claude-sandbox-runtime.js.map

package/dist/sandbox/claude-sandbox-settings.d.ts

@@ -0,0 +1,23 @@
+import type { SandboxRuntimeConfig } from '@anthropic-ai/sandbox-runtime';
+import type { ClaudeJsonResource } from '../compatibility/claude/shared-resources.js';
+export interface ClaudeSandboxSettings {
+    enabled: boolean;
+    failIfUnavailable: boolean;
+    autoAllowBashIfSandboxed: boolean;
+    allowUnsandboxedCommands: boolean;
+    enabledPlatforms?: readonly ('macos' | 'linux' | 'windows' | 'wsl')[];
+    excludedCommands: readonly string[];
+    bareGitRepoScrubPaths?: readonly string[];
+    runtimeConfig: SandboxRuntimeConfig;
+}
+export declare function claudeSandboxTempDirectory(environment?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): string;
+export declare function loadClaudeSandboxSettings({ resources, cwd, originalCwd, configRoot, homeDirectory, additionalDirectories, tempDirectory, }: {
+    resources: readonly ClaudeJsonResource[];
+    cwd: string;
+    originalCwd?: string;
+    configRoot: string;
+    homeDirectory: string;
+    additionalDirectories?: readonly string[];
+    tempDirectory: string;
+}): ClaudeSandboxSettings;
+//# sourceMappingURL=claude-sandbox-settings.d.ts.map

package/dist/sandbox/claude-sandbox-settings.js

@@ -0,0 +1,286 @@
+import { dirname, isAbsolute, resolve, sep } from 'node:path';
+import { readFileSync, realpathSync, statSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { permissionRuleValueFromString } from '../permissions/permission-updates.js';
+export function claudeSandboxTempDirectory(environment = process.env, platform = process.platform) {
+    const base = environment.CLAUDE_CODE_TMPDIR || (platform === 'win32' ? tmpdir() : '/tmp');
+    let canonicalBase = base;
+    try {
+        canonicalBase = realpathSync(base);
+    }
+    catch {
+        // Preserve the configured path when it does not exist yet.
+    }
+    const name = platform === 'win32' ? 'claude' : `claude-${process.getuid?.() ?? 0}`;
+    return resolve(canonicalBase, name);
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function booleanField(value, key, fallback, path) {
+    const field = value[key];
+    if (field === undefined)
+        return fallback;
+    if (typeof field !== 'boolean')
+        throw new Error(`sandbox.${key} must be a boolean: ${path}`);
+    return field;
+}
+function stringArray(value, key, path) {
+    const field = value[key];
+    if (field === undefined)
+        return [];
+    if (!Array.isArray(field) || field.some((item) => typeof item !== 'string'))
+        throw new Error(`sandbox.${key} must be an array of strings: ${path}`);
+    return field;
+}
+function appendUnique(target, values) {
+    for (const value of values)
+        if (!target.includes(value))
+            target.push(value);
+}
+function resourceRoot(resource) {
+    return resource.scope === 'user'
+        ? dirname(resource.path)
+        : resolve(dirname(resource.path), '..');
+}
+function permissionPath(pattern, resource) {
+    if (pattern.startsWith('//'))
+        return pattern.slice(1);
+    if (pattern.startsWith('/') && !pattern.startsWith('//')) {
+        return resolve(resourceRoot(resource), pattern.slice(1));
+    }
+    return pattern;
+}
+function filesystemPath(pattern, resource, homeDirectory) {
+    if (pattern.startsWith('//'))
+        return pattern.slice(1);
+    if (pattern === '~' || pattern.startsWith('~/')) {
+        return resolve(homeDirectory, pattern.slice(2));
+    }
+    return isAbsolute(pattern)
+        ? resolve(pattern)
+        : resolve(resourceRoot(resource), pattern);
+}
+function additionalDirectoryPath(path, cwd, homeDirectory) {
+    if (path === '~' || path.startsWith('~/'))
+        return resolve(homeDirectory, path.slice(2));
+    return isAbsolute(path) ? resolve(path) : resolve(cwd, path);
+}
+function nestedRecord(value, key, path) {
+    const field = value[key];
+    if (field === undefined)
+        return undefined;
+    if (!isRecord(field))
+        throw new Error(`sandbox.${key} must be an object: ${path}`);
+    return field;
+}
+function worktreeMainRepository(cwd) {
+    try {
+        const match = /^gitdir:\s*(.+)$/mu.exec(readFileSync(resolve(cwd, '.git'), 'utf8'));
+        if (!match?.[1])
+            return undefined;
+        const gitDirectory = resolve(cwd, match[1].trim());
+        const marker = `${sep}.git${sep}worktrees${sep}`;
+        const markerIndex = gitDirectory.lastIndexOf(marker);
+        return markerIndex > 0 ? gitDirectory.slice(0, markerIndex) : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export function loadClaudeSandboxSettings({ resources, cwd, originalCwd = cwd, configRoot, homeDirectory, additionalDirectories = [], tempDirectory, }) {
+    let enabled = false;
+    let failIfUnavailable = false;
+    let autoAllowBashIfSandboxed = true;
+    let allowUnsandboxedCommands = true;
+    let enabledPlatforms;
+    const excludedCommands = [];
+    const allowedDomains = [];
+    const deniedDomains = [];
+    const allowWrite = ['.', tempDirectory, ...additionalDirectories];
+    const protectedDirectories = [
+        ...new Set([resolve(originalCwd), resolve(cwd)]),
+    ];
+    const denyWrite = [resolve(configRoot, 'settings.json')];
+    for (const directory of protectedDirectories) {
+        denyWrite.push(resolve(directory, '.claude', 'settings.json'), resolve(directory, '.claude', 'settings.local.json'), resolve(directory, '.claude', 'commands'), resolve(directory, '.claude', 'agents'), resolve(directory, '.claude', 'skills'));
+    }
+    const denyRead = [];
+    const allowRead = [];
+    let allowUnixSockets;
+    let allowAllUnixSockets;
+    let allowLocalBinding;
+    let httpProxyPort;
+    let socksProxyPort;
+    let ignoreViolations;
+    let enableWeakerNestedSandbox;
+    let enableWeakerNetworkIsolation;
+    let ripgrep;
+    const bareGitRepoScrubPaths = [];
+    const worktreeRepository = worktreeMainRepository(cwd);
+    if (worktreeRepository && worktreeRepository !== resolve(cwd)) {
+        appendUnique(allowWrite, [worktreeRepository]);
+    }
+    for (const directory of protectedDirectories) {
+        for (const name of ['HEAD', 'objects', 'refs', 'hooks', 'config']) {
+            const path = resolve(directory, name);
+            try {
+                statSync(path);
+                appendUnique(denyWrite, [path]);
+            }
+            catch {
+                bareGitRepoScrubPaths.push(path);
+            }
+        }
+    }
+    for (const resource of resources) {
+        if (!isRecord(resource.value))
+            continue;
+        const permissions = isRecord(resource.value.permissions)
+            ? resource.value.permissions
+            : undefined;
+        if (permissions?.additionalDirectories !== undefined) {
+            if (!Array.isArray(permissions.additionalDirectories) ||
+                permissions.additionalDirectories.some((directory) => typeof directory !== 'string')) {
+                throw new Error(`permissions.additionalDirectories must be an array of strings: ${resource.path}`);
+            }
+            appendUnique(allowWrite, permissions.additionalDirectories.map((directory) => additionalDirectoryPath(directory, cwd, homeDirectory)));
+        }
+        for (const behavior of ['allow', 'deny']) {
+            const rawRules = permissions?.[behavior];
+            if (rawRules === undefined)
+                continue;
+            if (!Array.isArray(rawRules) ||
+                rawRules.some((rule) => typeof rule !== 'string')) {
+                throw new Error(`permissions.${behavior} must be an array of strings: ${resource.path}`);
+            }
+            for (const rawRule of rawRules) {
+                const rule = permissionRuleValueFromString(rawRule);
+                if (rule.toolName === 'WebFetch' &&
+                    rule.ruleContent?.startsWith('domain:')) {
+                    appendUnique(behavior === 'allow' ? allowedDomains : deniedDomains, [
+                        rule.ruleContent.slice('domain:'.length),
+                    ]);
+                }
+                if (rule.toolName === 'Edit' && rule.ruleContent) {
+                    appendUnique(behavior === 'allow' ? allowWrite : denyWrite, [
+                        permissionPath(rule.ruleContent, resource),
+                    ]);
+                }
+                if (behavior === 'deny' &&
+                    rule.toolName === 'Read' &&
+                    rule.ruleContent) {
+                    appendUnique(denyRead, [permissionPath(rule.ruleContent, resource)]);
+                }
+            }
+        }
+        const sandbox = resource.value.sandbox;
+        if (sandbox === undefined)
+            continue;
+        if (!isRecord(sandbox))
+            throw new Error(`sandbox must be an object: ${resource.path}`);
+        enabled = booleanField(sandbox, 'enabled', enabled, resource.path);
+        failIfUnavailable = booleanField(sandbox, 'failIfUnavailable', failIfUnavailable, resource.path);
+        autoAllowBashIfSandboxed = booleanField(sandbox, 'autoAllowBashIfSandboxed', autoAllowBashIfSandboxed, resource.path);
+        allowUnsandboxedCommands = booleanField(sandbox, 'allowUnsandboxedCommands', allowUnsandboxedCommands, resource.path);
+        appendUnique(excludedCommands, stringArray(sandbox, 'excludedCommands', resource.path));
+        const platforms = sandbox.enabledPlatforms;
+        if (platforms !== undefined) {
+            if (!Array.isArray(platforms) ||
+                platforms.some((platform) => !['macos', 'linux', 'windows', 'wsl'].includes(String(platform)))) {
+                throw new Error(`sandbox.enabledPlatforms contains an unsupported platform: ${resource.path}`);
+            }
+            enabledPlatforms = platforms;
+        }
+        const network = nestedRecord(sandbox, 'network', resource.path);
+        if (network) {
+            appendUnique(allowedDomains, stringArray(network, 'allowedDomains', resource.path));
+            const unixSockets = stringArray(network, 'allowUnixSockets', resource.path);
+            if (unixSockets.length > 0) {
+                allowUnixSockets ??= [];
+                appendUnique(allowUnixSockets, unixSockets);
+            }
+            allowAllUnixSockets = booleanField(network, 'allowAllUnixSockets', allowAllUnixSockets ?? false, resource.path);
+            allowLocalBinding = booleanField(network, 'allowLocalBinding', allowLocalBinding ?? false, resource.path);
+            for (const key of ['httpProxyPort', 'socksProxyPort']) {
+                const value = network[key];
+                if (value !== undefined && (typeof value !== 'number' || value <= 0)) {
+                    throw new Error(`sandbox.network.${key} must be a positive number: ${resource.path}`);
+                }
+            }
+            if (typeof network.httpProxyPort === 'number')
+                httpProxyPort = network.httpProxyPort;
+            if (typeof network.socksProxyPort === 'number')
+                socksProxyPort = network.socksProxyPort;
+        }
+        const filesystem = nestedRecord(sandbox, 'filesystem', resource.path);
+        if (filesystem) {
+            for (const [key, target] of [
+                ['allowWrite', allowWrite],
+                ['denyWrite', denyWrite],
+                ['denyRead', denyRead],
+                ['allowRead', allowRead],
+            ]) {
+                appendUnique(target, stringArray(filesystem, key, resource.path).map((path) => filesystemPath(path, resource, homeDirectory)));
+            }
+        }
+        const ignored = sandbox.ignoreViolations;
+        if (ignored !== undefined) {
+            if (!isRecord(ignored))
+                throw new Error(`sandbox.ignoreViolations must be an object: ${resource.path}`);
+            ignoreViolations = { ...(ignoreViolations ?? {}) };
+            for (const [command, values] of Object.entries(ignored)) {
+                if (!Array.isArray(values) ||
+                    values.some((value) => typeof value !== 'string')) {
+                    throw new Error(`sandbox.ignoreViolations.${command} must be an array of strings: ${resource.path}`);
+                }
+                ignoreViolations[command] = [
+                    ...new Set([...(ignoreViolations[command] ?? []), ...values]),
+                ];
+            }
+        }
+        enableWeakerNestedSandbox = booleanField(sandbox, 'enableWeakerNestedSandbox', enableWeakerNestedSandbox ?? false, resource.path);
+        enableWeakerNetworkIsolation = booleanField(sandbox, 'enableWeakerNetworkIsolation', enableWeakerNetworkIsolation ?? false, resource.path);
+        const configuredRipgrep = nestedRecord(sandbox, 'ripgrep', resource.path);
+        if (configuredRipgrep) {
+            if (typeof configuredRipgrep.command !== 'string') {
+                throw new Error(`sandbox.ripgrep.command must be a string: ${resource.path}`);
+            }
+            const args = stringArray(configuredRipgrep, 'args', resource.path);
+            ripgrep = {
+                command: configuredRipgrep.command,
+                ...(args.length > 0 ? { args } : {}),
+            };
+        }
+    }
+    return {
+        enabled,
+        failIfUnavailable,
+        autoAllowBashIfSandboxed,
+        allowUnsandboxedCommands,
+        ...(enabledPlatforms ? { enabledPlatforms } : {}),
+        excludedCommands,
+        bareGitRepoScrubPaths,
+        runtimeConfig: {
+            network: {
+                allowedDomains,
+                deniedDomains,
+                ...(allowUnixSockets ? { allowUnixSockets } : {}),
+                ...(allowAllUnixSockets === undefined ? {} : { allowAllUnixSockets }),
+                ...(allowLocalBinding === undefined ? {} : { allowLocalBinding }),
+                ...(httpProxyPort === undefined ? {} : { httpProxyPort }),
+                ...(socksProxyPort === undefined ? {} : { socksProxyPort }),
+            },
+            filesystem: { allowWrite, denyWrite, denyRead, allowRead },
+            ...(ignoreViolations ? { ignoreViolations } : {}),
+            ...(enableWeakerNestedSandbox === undefined
+                ? {}
+                : { enableWeakerNestedSandbox }),
+            ...(enableWeakerNetworkIsolation === undefined
+                ? {}
+                : { enableWeakerNetworkIsolation }),
+            ...(ripgrep ? { ripgrep } : {}),
+        },
+    };
+}
+//# sourceMappingURL=claude-sandbox-settings.js.map

package/dist/tools/local-tools.d.ts

@@ -10,6 +10,23 @@ export interface LocalToolRegistryOptions {
     maxShellTimeoutMs?: number;
     enableReportFindings?: boolean;
     environment?: Readonly<Record<string, string>>;
+    sandbox?: BashSandboxRuntime;
+}
+export interface BashSandboxRuntime {
+    shouldUseSandbox(input: {
+        command: string;
+        dangerouslyDisableSandbox?: boolean;
+    }): boolean;
+    wrapCommand(input: {
+        command: string;
+        dangerouslyDisableSandbox?: boolean;
+    }, options?: {
+        shell?: string;
+        signal?: AbortSignal;
+        commandId?: string;
+    }): Promise<string>;
+    annotateStderr(commandId: string, stderr: string): string;
+    cleanupAfterCommand(): void;
 }
 export declare class LocalToolRegistry implements ToolRegistry {
     private readonly cwd;
@@ -23,6 +40,7 @@ export declare class LocalToolRegistry implements ToolRegistry {
     private readonly processRunner;
     private readonly enableReportFindings;
     private readonly environment;
+    private readonly sandbox;
     constructor(options: LocalToolRegistryOptions);
     private currentCwd;
     definitions(): readonly ModelToolDefinition[];

package/dist/tools/local-tools.js

@@ -434,6 +434,7 @@ export class LocalToolRegistry {
     processRunner;
     enableReportFindings;
     environment;
+    sandbox;
     constructor(options) {
         this.cwd = resolve(options.cwd);
         this.cwdProvider = options.cwdProvider;
@@ -447,6 +448,7 @@ export class LocalToolRegistry {
         this.maxShellTimeoutMs = options.maxShellTimeoutMs ?? 120_000;
         this.enableReportFindings = options.enableReportFindings ?? false;
         this.environment = options.environment;
+        this.sandbox = options.sandbox;
         this.processRunner = new BoundedProcessRunner({
             cwd: this.cwd,
             maxOutputBytes: this.maxOutputBytes,
@@ -586,11 +588,19 @@ export class LocalToolRegistry {
             }
             case 'Bash': {
                 const requestedTimeout = optionalPositiveInteger(call.input, 'timeout');
+                const dangerouslyDisableSandbox = call.input.dangerouslyDisableSandbox;
+                if (dangerouslyDisableSandbox !== undefined &&
+                    typeof dangerouslyDisableSandbox !== 'boolean') {
+                    throw new Error('dangerouslyDisableSandbox must be a boolean');
+                }
                 return {
                     ...call,
                     input: {
                         command: stringInput(call.input, 'command'),
                         timeout: Math.min(requestedTimeout ?? this.maxShellTimeoutMs, this.maxShellTimeoutMs),
+                        ...(dangerouslyDisableSandbox === undefined
+                            ? {}
+                            : { dangerouslyDisableSandbox }),
                     },
                 };
             }
@@ -1077,14 +1087,43 @@ export class LocalToolRegistry {
         const timeout = optionalPositiveInteger(call.input, 'timeout');
         if (timeout === undefined)
             throw new Error('Prepared Bash call has no timeout');
-        const result = await this.processRunner.run({
-            command: commandShell(),
-            args: commandShellArguments(stringInput(call.input, 'command')),
-            timeoutMs: timeout,
-            cwd: this.currentCwd(context),
-            ...(this.environment ? { env: this.environment } : {}),
-            ...(context.signal ? { signal: context.signal } : {}),
-        });
+        const rawCommand = stringInput(call.input, 'command');
+        const sandboxInput = {
+            command: rawCommand,
+            ...(call.input.dangerouslyDisableSandbox === true
+                ? { dangerouslyDisableSandbox: true }
+                : {}),
+        };
+        const sandboxed = this.sandbox?.shouldUseSandbox(sandboxInput) ?? false;
+        const shell = commandShell();
+        let result;
+        try {
+            const command = sandboxed
+                ? await this.sandbox?.wrapCommand(sandboxInput, {
+                    shell,
+                    ...(context.signal ? { signal: context.signal } : {}),
+                    commandId: call.id,
+                })
+                : rawCommand;
+            result = await this.processRunner.run({
+                command: shell,
+                args: commandShellArguments(command ?? rawCommand),
+                timeoutMs: timeout,
+                cwd: this.currentCwd(context),
+                ...(this.environment ? { env: this.environment } : {}),
+                ...(context.signal ? { signal: context.signal } : {}),
+            });
+        }
+        finally {
+            if (sandboxed)
+                this.sandbox?.cleanupAfterCommand();
+        }
+        if (sandboxed && this.sandbox) {
+            result = {
+                ...result,
+                stderr: this.sandbox.annotateStderr(call.id, result.stderr),
+            };
+        }
         if (result.timedOut) {
             return {
                 content: `Command timed out after ${timeout}ms`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "praxis-agent",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Local-first, single-user general agent for the command line.",
   "license": "MIT",
   "author": "wuqisen",
@@ -111,6 +111,7 @@
     "provenance": true
   },
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "^0.0.73",
     "@anthropic-ai/tokenizer": "^0.0.4",
     "@modelcontextprotocol/sdk": "^1.30.0",
     "acorn": "^8.18.0",