shortcutxl 0.2.19 → 0.2.21

package/dist/custom/sandbox/lib/types.js

@@ -0,0 +1,9 @@
+/**
+ * Public types for the sandbox package.
+ *
+ * SandboxConfig is what callers provide.
+ * SandboxState is the resolved, ready-to-use internal state.
+ * WrappedCommand is what wrapCommand() returns.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/custom/sandbox/lib/wrap-command.js

@@ -0,0 +1,110 @@
+/**
+ * Core sandbox API: command transformer.
+ *
+ * Takes a user command and resolved sandbox state,
+ * returns a spawn-ready WrappedCommand.
+ */
+import { buildBwrapArgs } from './bwrap.js';
+/** Port for the HTTP proxy socat bridge inside the sandbox network namespace. */
+export const HTTP_PROXY_PORT = 8899;
+/** Port for the SOCKS5 proxy socat bridge inside the sandbox network namespace. */
+export const SOCKS_PROXY_PORT = 1080;
+/** Path to the apply-seccomp binary inside the rootfs. */
+export const SECCOMP_BINARY = '/usr/local/bin/apply-seccomp';
+/** Validate a socket path to prevent shell injection. */
+function validateSocketPath(path) {
+    if (!/^[a-zA-Z0-9._\-\/]+$/.test(path)) {
+        throw new Error(`Invalid proxy socket path: ${path}`);
+    }
+}
+/**
+ * Wrap a command string with apply-seccomp.
+ *
+ * apply-seccomp loads the BPF filter, then exec's the command.
+ * The filter persists across exec — all children inherit it.
+ * Single quotes in the command are escaped for nested bash -c.
+ */
+function wrapWithSeccomp(command, filterPath) {
+    // Escape single quotes for nesting inside bash -c '...'
+    const escaped = command.replace(/'/g, "'\\''");
+    return `${SECCOMP_BINARY} ${filterPath} bash -c '${escaped}'`;
+}
+/**
+ * Wrap a shell command with WSL + bwrap isolation.
+ *
+ * Returns a WrappedCommand that the caller spawns with child_process.spawn().
+ * The sandbox owns command construction; the caller owns process lifecycle.
+ *
+ * The `command` parameter is trusted — it comes from the agent, not from user input.
+ * Socket paths are validated to prevent injection.
+ *
+ * @param options.cwd - Override the working directory (Linux path).
+ * @param options.httpSocketPath - HTTP proxy socket (set by SandboxManager).
+ * @param options.socksSocketPath - SOCKS5 proxy socket (set by SandboxManager).
+ */
+export function wrapCommand(command, state, options) {
+    const bwrapArgs = buildBwrapArgs(state, options);
+    const httpSocketPath = options?.httpSocketPath;
+    const socksSocketPath = options?.socksSocketPath;
+    const seccomp = state.seccompFilterPath;
+    // The user command — optionally wrapped with seccomp.
+    // In proxy mode, seccomp wraps ONLY the user command (not the socat setup),
+    // because socat needs AF_UNIX sockets for the proxy bridges.
+    // In non-proxy mode, seccomp wraps the entire command.
+    let resolvedCommand = seccomp ? wrapWithSeccomp(command, seccomp) : command;
+    if (state.networkMode === 'proxy' && httpSocketPath) {
+        validateSocketPath(httpSocketPath);
+        if (socksSocketPath)
+            validateSocketPath(socksSocketPath);
+        // Build socat bridges and env vars for both proxies.
+        // Each bwrap has its own network namespace, so ports don't collide.
+        const setup = [];
+        // HTTP proxy: socat bridge
+        setup.push(`socat TCP-LISTEN:${HTTP_PROXY_PORT},reuseaddr,fork UNIX-CONNECT:${httpSocketPath} & HTTP_PID=$!`);
+        // SOCKS5 proxy: socat bridge
+        if (socksSocketPath) {
+            setup.push(`socat TCP-LISTEN:${SOCKS_PROXY_PORT},reuseaddr,fork UNIX-CONNECT:${socksSocketPath} & SOCKS_PID=$!`);
+        }
+        // Wait for bridges to be ready
+        setup.push(`for _i in 1 2 3 4 5; do nc -z 127.0.0.1 ${HTTP_PROXY_PORT} 2>/dev/null && break; sleep 0.1; done`);
+        if (socksSocketPath) {
+            setup.push(`for _i in 1 2 3 4 5; do nc -z 127.0.0.1 ${SOCKS_PROXY_PORT} 2>/dev/null && break; sleep 0.1; done`);
+        }
+        // HTTP proxy env vars
+        setup.push(`export HTTP_PROXY=http://127.0.0.1:${HTTP_PROXY_PORT}`, `export HTTPS_PROXY=http://127.0.0.1:${HTTP_PROXY_PORT}`, `export http_proxy=http://127.0.0.1:${HTTP_PROXY_PORT}`, `export https_proxy=http://127.0.0.1:${HTTP_PROXY_PORT}`);
+        // SOCKS5 proxy env vars (for SSH, databases, gRPC, etc.)
+        if (socksSocketPath) {
+            setup.push(`export ALL_PROXY=socks5://127.0.0.1:${SOCKS_PROXY_PORT}`, `export all_proxy=socks5://127.0.0.1:${SOCKS_PROXY_PORT}`);
+        }
+        // Force all traffic through proxies — no bypass, even for localhost.
+        // Sandboxed commands have their own network namespace; any external
+        // connection must go through the proxy for domain filtering.
+        setup.push('export no_proxy=', 'export NO_PROXY=');
+        // Route SSH through SOCKS5 proxy for git-over-SSH
+        // Use netcat's SOCKS5 client mode (-X 5) since the proxy speaks SOCKS5.
+        if (socksSocketPath) {
+            setup.push(`export GIT_SSH_COMMAND="ssh -o 'ProxyCommand=socat - SOCKS4A:127.0.0.1:%h:%p,socksport=${SOCKS_PROXY_PORT}'"`);
+        }
+        const proxySetup = setup.join('; ');
+        // Cleanup: kill socat bridges after command finishes
+        const cleanup = ['kill $HTTP_PID 2>/dev/null'];
+        if (socksSocketPath)
+            cleanup.push('kill $SOCKS_PID 2>/dev/null');
+        // Two-stage execution: socat bridges start first (need AF_UNIX),
+        // then resolvedCommand runs (already wrapped with apply-seccomp if enabled).
+        resolvedCommand = `${proxySetup}; ${resolvedCommand}; EXIT=$?; ${cleanup.join('; ')}; true; exit $EXIT`;
+    }
+    const args = [
+        '-d',
+        state.distro,
+        '--',
+        'bwrap',
+        ...bwrapArgs,
+        '--',
+        'bash',
+        '-c',
+        resolvedCommand
+    ];
+    return { file: 'wsl', args };
+}
+//# sourceMappingURL=wrap-command.js.map

package/dist/custom/sandbox/{wsl-detect.js → lib/wsl-detect.js}

@@ -5,7 +5,7 @@
  */
 import { spawnSync } from 'child_process';
 let _wsl2Available;
-let _distroCache = new Map();
+const _distroCache = new Map();
 /**
  * Check if WSL2 is available on this system.
  * Cached after first call.
@@ -19,14 +19,14 @@ export function isWsl2Available() {
             encoding: 'utf-8',
             windowsHide: true
         });
-        // wsl --status exits 0 when WSL is installed. We need WSL2 specifically
-        // (bubblewrap requires a real Linux kernel). Check for "Default Version: 2"
-        // or the WSL2-specific kernel version string.
-        // wsl --status may emit UTF-16LE with NUL bytes — strip them like -l -v
+        // wsl --status exits 0 when WSL is installed. We need WSL2 specifically.
+        // wsl --status may emit UTF-16LE with NUL bytes — strip them.
         const output = ((result.stdout ?? '') + (result.stderr ?? '')).replace(/\0/g, '');
-        _wsl2Available = result.status === 0 && (/Default Version\s*:\s*2/i.test(output) ||
-            /WSL\s*2/i.test(output) ||
-            /kernel version/i.test(output));
+        _wsl2Available =
+            result.status === 0 &&
+                (/Default Version\s*:\s*2/i.test(output) ||
+                    /WSL\s*2/i.test(output) ||
+                    /kernel version/i.test(output));
     }
     catch {
         _wsl2Available = false;
@@ -46,9 +46,7 @@ export function isDistroInstalled(name) {
             encoding: 'utf-8',
             windowsHide: true
         });
-        // Output uses UTF-16LE with NUL bytes; clean it up
         const output = (result.stdout ?? '').replace(/\0/g, '');
-        // Token match to avoid false positives (e.g. 'short' matching 'shortcutxl')
         const tokens = output.split(/\s+/);
         const installed = tokens.some((t) => t === name);
         _distroCache.set(name, installed);
@@ -59,11 +57,9 @@ export function isDistroInstalled(name) {
         return false;
     }
 }
-/**
- * Clear the detection cache. Useful after importing a new distro.
- */
+/** Clear the detection cache. Call after importing/unregistering a distro. */
 export function clearDetectionCache() {
     _wsl2Available = undefined;
-    _distroCache = new Map();
+    _distroCache.clear();
 }
 //# sourceMappingURL=wsl-detect.js.map

package/dist/custom/sandbox/lib/wsl-setup.js

@@ -0,0 +1,152 @@
+/**
+ * WSL2 distro import and setup.
+ *
+ * Handles importing a rootfs tarball into WSL2 and verifying the result.
+ * The rootfs path and distro storage dir are provided by the caller —
+ * this package has no opinion about where they live.
+ */
+import { spawn, spawnSync } from 'child_process';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
+import { join } from 'path';
+import { log } from '../../../utils/log.js';
+import { runSandboxSmokeTestAsync } from './smoke.js';
+import { clearDetectionCache, isDistroInstalled, isWsl2Available } from './wsl-detect.js';
+/**
+ * Ensure the WSL2 sandbox distro is ready.
+ *
+ * 1. Verify WSL2 is available
+ * 2. Check if distro already exists → smoke test
+ * 3. Import rootfs via `wsl --import` → smoke test
+ */
+export async function ensureWslSandbox(options) {
+    const { distro, wslDir, rootfsPath, version } = options;
+    if (!isWsl2Available()) {
+        return { installed: false, error: 'WSL2 is not available' };
+    }
+    const stampFile = join(wslDir, distro, '.rootfs-version');
+    // Already installed? Check version stamp.
+    if (isDistroInstalled(distro)) {
+        if (version && !isRootfsStale(stampFile, version)) {
+            // Version matches — already up to date, skip smoke test.
+            return { installed: true };
+        }
+        // Stale or missing stamp — unregister and reimport.
+        log.info('sandbox', `Rootfs stale or unversioned — reimporting (version=${version})`);
+        const unregResult = await spawnAsync('wsl', ['--unregister', distro], 10_000);
+        clearDetectionCache();
+        if (unregResult.exitCode !== 0) {
+            return {
+                installed: false,
+                error: `Rootfs update needed but failed to unregister — manual \`wsl --unregister ${distro}\` may be needed`
+            };
+        }
+        // Fall through to re-import
+    }
+    // Import rootfs
+    if (!existsSync(rootfsPath)) {
+        return { installed: false, error: `Rootfs not found at ${rootfsPath}` };
+    }
+    const installDir = join(wslDir, distro);
+    if (!existsSync(installDir)) {
+        mkdirSync(installDir, { recursive: true });
+    }
+    const importResult = await spawnAsync('wsl', ['--import', distro, installDir, rootfsPath, '--version', '2'], 60_000);
+    if (importResult.exitCode !== 0) {
+        return {
+            installed: false,
+            error: `WSL import failed: ${importResult.stderr.replace(/\0/g, '')}`
+        };
+    }
+    clearDetectionCache();
+    // Smoke test
+    const smoke = await runSandboxSmokeTestAsync(distro);
+    if (smoke.ok) {
+        if (version)
+            writeStamp(stampFile, version);
+        return { installed: true };
+    }
+    const unregResult = await spawnAsync('wsl', ['--unregister', distro], 10_000);
+    const unregistered = unregResult.exitCode === 0;
+    clearDetectionCache();
+    const failed = smoke.checks.filter((c) => !c.ok).map((c) => c.name);
+    const suffix = unregistered
+        ? ' (distro unregistered — retry will re-import)'
+        : ' (warning: failed to unregister broken distro — manual `wsl --unregister` may be needed)';
+    return {
+        installed: false,
+        error: `Import succeeded but smoke test failed${suffix}. Missing: ${failed.join(', ')}`
+    };
+}
+/**
+ * Enable WSL2 on a machine that doesn't have it yet.
+ * Requires admin privileges (will trigger UAC prompt).
+ */
+export function enableWsl2() {
+    const result = spawnSync('wsl', ['--install', '--no-distribution'], {
+        timeout: 120_000,
+        encoding: 'utf-8',
+        windowsHide: true
+    });
+    const output = ((result.stdout ?? '') + (result.stderr ?? '')).replace(/\0/g, '');
+    if (result.status === 0) {
+        const needsReboot = /reboot|restart/i.test(output);
+        return { success: true, needsReboot };
+    }
+    return { success: false, needsReboot: false, error: output || 'Failed to enable WSL2' };
+}
+function isRootfsStale(stampFile, currentVersion) {
+    try {
+        return !existsSync(stampFile) || readFileSync(stampFile, 'utf-8').trim() !== currentVersion;
+    }
+    catch {
+        return true;
+    }
+}
+function writeStamp(stampFile, version) {
+    try {
+        writeFileSync(stampFile, version, 'utf-8');
+    }
+    catch (err) {
+        log.warn('sandbox', 'Failed to write rootfs version stamp', err);
+    }
+}
+/** Non-blocking spawn wrapper. */
+function spawnAsync(cmd, args, timeoutMs) {
+    return new Promise((resolve) => {
+        const child = spawn(cmd, args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            windowsHide: true
+        });
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        child.stdout?.on('data', (chunk) => {
+            stdout += chunk.toString();
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderr += chunk.toString();
+        });
+        child.on('error', () => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve({ exitCode: null, stdout, stderr });
+            }
+        });
+        const timer = setTimeout(() => {
+            if (!settled) {
+                settled = true;
+                child.kill();
+                resolve({ exitCode: null, stdout, stderr });
+            }
+        }, timeoutMs);
+        child.on('close', (code) => {
+            if (!settled) {
+                settled = true;
+                clearTimeout(timer);
+                resolve({ exitCode: code, stdout, stderr });
+            }
+        });
+    });
+}
+//# sourceMappingURL=wsl-setup.js.map

package/dist/custom/sandbox/sandbox-bash-tool.js

@@ -22,8 +22,10 @@ import { createNetworkPrompt } from './sandbox-prompt.js';
  */
 export function createSandboxBashTool(cwd, settingsManager) {
     const sandboxMgr = new SandboxManager(cwd, settingsManager);
-    // Start network proxy if in proxy mode (async, non-blocking).
-    if (sandboxMgr.getConfig().networkMode === 'proxy') {
+    // Start network proxy if in proxy mode.
+    // The startup promise is tracked by SandboxManager — the executor
+    // calls ensureReady() before each command, so there's no race.
+    if (sandboxMgr.getState().networkMode === 'proxy') {
         // Domain check prompts need a UI context, which is only available during
         // tool execution. We store a per-invocation context ref that the proxy
         // callback reads. This ref may be overwritten by concurrent tool calls,
@@ -34,7 +36,8 @@ export function createSandboxBashTool(cwd, settingsManager) {
         // Without this, concurrent bash commands cause overlapping prompts
         // where only one succeeds and the rest get denied.
         let promptQueue = Promise.resolve();
-        sandboxMgr.startProxy({
+        sandboxMgr
+            .startProxy({
             onDomainCheck: async (domain) => {
                 if (!activeCtx?.hasUI) {
                     return 'once';
@@ -52,20 +55,22 @@ export function createSandboxBashTool(cwd, settingsManager) {
                     });
                 });
             }
-        }).catch(() => {
+        })
+            .catch(() => {
             // Proxy failed to start — fall back to no network so the user
             // isn't silently blocked thinking they have proxy-mode network.
             sandboxMgr.setNetworkMode('none');
         });
-        // Expose the ctx setter so execute() can update it
-        return buildTool(cwd, sandboxMgr, (ctx) => { activeCtx = ctx; });
+        return buildTool(cwd, sandboxMgr, (ctx) => {
+            activeCtx = ctx;
+        });
     }
     return buildTool(cwd, sandboxMgr);
 }
 // ---------------------------------------------------------------------------
 function buildTool(cwd, sandboxMgr, setActiveCtx) {
     const baseTool = createBashTool(cwd, {
-        operations: createSandboxOperations(sandboxMgr.getConfig()),
+        operations: createSandboxOperations(sandboxMgr),
         sandboxActive: true
     });
     return {

package/dist/custom/sandbox/sandbox-command.js

@@ -4,11 +4,11 @@
  * - Not installed → runs WSL2 + bubblewrap setup flow
  * - Already installed → shows settings menu (enable/disable, network, write paths, allowed domains)
  */
-import { execSync } from 'node:child_process';
+import { enableWsl2, ensureWslSandbox, isDistroInstalled, isWsl2Available } from './lib/index.js';
 import chalk from 'chalk';
-import { getWslDir, getSettingsPath } from '../../config.js';
-import { isWsl2Available, isDistroInstalled, ensureWslSandbox, enableWsl2 } from './index.js';
-import { SANDBOX_DISTRO } from './sandbox-config.js';
+import { execSync } from 'node:child_process';
+import { getAlpineRootfsPath, getSettingsPath, getWslDir, VERSION } from '../../config.js';
+import { SANDBOX_DISTRO } from './index.js';
 const WSL_INSTALL_HINT = '\n\n  To fix this:\n' +
     '  1. Open PowerShell or Command Prompt as Administrator\n' +
     '  2. Run: wsl --install\n' +
@@ -38,7 +38,12 @@ export async function handleSandboxCommand(showStatus, select, input, settingsMa
     }
     // Step 3: Not installed → set up
     showStatus('Setting up sandbox (importing Alpine Linux + bubblewrap)...');
-    const result = await ensureWslSandbox({ distro: SANDBOX_DISTRO, wslDir: getWslDir() });
+    const result = await ensureWslSandbox({
+        distro: SANDBOX_DISTRO,
+        wslDir: getWslDir(),
+        rootfsPath: getAlpineRootfsPath(),
+        version: VERSION
+    });
     if (result.installed) {
         settingsManager.setSandboxMode('enabled');
         showStatus('Sandbox ready — restart session to activate');
@@ -67,7 +72,7 @@ async function showSettingsMenu(showStatus, select, input, sm) {
         `Allowed domains (${allowedDomains.length})`,
         'Reset to defaults',
         'Open config file',
-        'Cancel',
+        'Cancel'
     ]);
     if (!choice || choice === 'Cancel')
         return;
@@ -85,19 +90,19 @@ async function showSettingsMenu(showStatus, select, input, sm) {
     else if (choice.startsWith('Read paths')) {
         await showListMenu('Read Paths', readPaths ?? [], showStatus, select, input, {
             placeholder: 'D:\\SharedData',
-            onSave: (paths) => sm.setSandboxReadPaths(paths),
+            onSave: (paths) => sm.setSandboxReadPaths(paths)
         });
     }
     else if (choice.startsWith('Write paths')) {
         await showListMenu('Write Paths', writePaths ?? [], showStatus, select, input, {
             placeholder: 'C:\\Users\\you\\Downloads',
-            onSave: (paths) => sm.setSandboxWritePaths(paths),
+            onSave: (paths) => sm.setSandboxWritePaths(paths)
         });
     }
     else if (choice.startsWith('Allowed domains')) {
         await showListMenu('Allowed Domains', allowedDomains, showStatus, select, input, {
             placeholder: '*.github.com',
-            onSave: (domains) => sm.setSandboxAllowedDomains(domains),
+            onSave: (domains) => sm.setSandboxAllowedDomains(domains)
         });
     }
     else if (choice === 'Reset to defaults') {
@@ -124,9 +129,9 @@ async function showNetworkMenu(showStatus, select, sm) {
     const labels = {
         none: 'None — no network access',
         proxy: 'Proxy — domain-level control with approval prompts',
-        full: 'Full — unrestricted network access',
+        full: 'Full — unrestricted network access'
     };
-    const options = modes.map((m) => m === current ? `${labels[m]} (current)` : labels[m]);
+    const options = modes.map((m) => (m === current ? `${labels[m]} (current)` : labels[m]));
     options.push('Cancel');
     const choice = await select('Network Mode', options);
     if (!choice || choice === 'Cancel')
@@ -138,11 +143,7 @@ async function showNetworkMenu(showStatus, select, sm) {
     }
 }
 async function showListMenu(title, items, showStatus, select, input, opts) {
-    const options = [
-        '+ Add...',
-        ...items.map((item) => `  ${item}`),
-        'Cancel',
-    ];
+    const options = ['+ Add...', ...items.map((item) => `  ${item}`), 'Cancel'];
     const choice = await select(title, options);
     if (!choice || choice === 'Cancel')
         return;

package/dist/custom/sandbox/sandbox-executor.js

@@ -1,52 +1,27 @@
 /**
  * Sandboxed BashOperations implementation.
  *
- * Routes commands through WSL2 + bubblewrap for filesystem and network isolation.
- * Implements the BashOperations interface from core/tools/bash.ts.
+ * Uses SandboxManager.wrapCommand() to build the sandboxed command,
+ * then owns the process lifecycle (spawn, kill, stream, timeout).
  */
+import { toLinuxPath } from './lib/index.js';
 import { spawn } from 'child_process';
 import { killProcessTree } from '../../utils/shell.js';
-import { buildBwrapArgs } from './sandbox-config.js';
 /**
  * Create a BashOperations that runs commands inside a WSL2 + bwrap sandbox.
  *
- * @param config - Resolved sandbox config (mounts, distro, workdir)
+ * The manager builds the command (with proxy socket + cwd); this function owns spawning it.
+ * Awaits manager.ensureReady() before the first command to prevent proxy startup races.
  */
-export function createSandboxOperations(config) {
+export function createSandboxOperations(manager) {
     return {
-        exec: (command, _cwd, { onData, signal, timeout }) => {
+        exec: async (command, cwd, { onData, signal, timeout }) => {
+            // Wait for proxy to be ready before first command
+            await manager.ensureReady();
+            const linuxCwd = cwd ? toLinuxPath(cwd) : undefined;
+            const wrapped = manager.wrapCommand(command, linuxCwd);
             return new Promise((resolve, reject) => {
-                const bwrapArgs = buildBwrapArgs(config);
-                // When proxy mode is active, start a socat bridge inside bwrap
-                // (unix socket → TCP localhost:8899) and route all traffic through it.
-                // --unshare-net ensures nothing can bypass the proxy.
-                let resolvedCommand = command;
-                if (config.networkMode === 'proxy' && config.proxySocketPath) {
-                    const proxySetup = [
-                        `socat TCP-LISTEN:8899,reuseaddr,fork UNIX-CONNECT:${config.proxySocketPath} & PROXY_PID=$!`,
-                        'for _i in 1 2 3 4 5; do nc -z 127.0.0.1 8899 2>/dev/null && break; sleep 0.1; done',
-                        'export HTTP_PROXY=http://127.0.0.1:8899',
-                        'export HTTPS_PROXY=http://127.0.0.1:8899',
-                        'export http_proxy=http://127.0.0.1:8899',
-                        'export https_proxy=http://127.0.0.1:8899',
-                        'export no_proxy=',
-                        'export NO_PROXY=',
-                    ].join('; ');
-                    resolvedCommand = `${proxySetup}; ${command}; EXIT=$?; kill $PROXY_PID 2>/dev/null; true; exit $EXIT`;
-                }
-                // spawn('wsl', args) passes each array element as a discrete OS-level
-                // argument (via Windows CreateProcess).  WSL forwards them directly to
-                // exec — no intermediate shell parses the args.  So the command string
-                // must be passed raw to `bash -c`; any extra quoting becomes literal
-                // characters that bash tries to execute as a command name.
-                const wslArgs = [
-                    '-d', config.distro,
-                    '--',
-                    'bwrap', ...bwrapArgs,
-                    '--',
-                    'bash', '-c', resolvedCommand
-                ];
-                const child = spawn('wsl', wslArgs, {
+                const child = spawn(wrapped.file, wrapped.args, {
                     stdio: ['ignore', 'pipe', 'pipe'],
                     windowsHide: true
                 });
@@ -80,7 +55,7 @@ export function createSandboxOperations(config) {
                         reject(err);
                     }
                 });
-                // Abort handling — kill via taskkill on the wsl.exe PID
+                // Abort handling
                 const onAbort = () => {
                     if (child.pid) {
                         killProcessTree(child.pid);

package/dist/custom/sandbox/sandbox-manager.js

@@ -1,39 +1,57 @@
 /**
- * Runtime sandbox configuration manager.
+ * Agent-side sandbox manager — thin adapter over @shortcut/sandbox.
  *
- * Holds the mutable SandboxState and supports:
- * - Adding write mounts at runtime (allow once / save to settings)
- * - Managing the network proxy lifecycle
+ * Maps agent's SettingsManager to the package's SandboxConfig,
+ * and wires domain persistence through SettingsManager.
+ */
+import { SandboxManager as PackageSandboxManager, toLinuxPath } from './lib/index.js';
+import { join } from 'path';
+import { getAgentDir } from '../../config.js';
+/** Map agent SandboxSettings to the package's SandboxConfig. */
+function toPackageConfig(settingsManager) {
+    const settings = settingsManager.getSandboxSettings();
+    const pipDir = toLinuxPath(join(getAgentDir(), 'pip-packages'));
+    return {
+        readPaths: settings.readPaths,
+        writePaths: settings.writePaths,
+        networkMode: settings.network ?? 'none',
+        env: {
+            PYTHONUSERBASE: pipDir,
+            PIP_USER: '1',
+            PIP_BREAK_SYSTEM_PACKAGES: '1',
+            PATH: `${pipDir}/bin:/usr/local/bin:/usr/bin:/bin`
+        }
+    };
+}
+/**
+ * Agent-side sandbox manager.
+ *
+ * Wraps the package SandboxManager and adds:
+ * - Settings → config mapping
+ * - Domain persistence via SettingsManager
  */
-import { resolveSandboxConfig } from './sandbox-config.js';
-import { startNetworkProxy, deployProxyWorker } from './network/index.js';
 export class SandboxManager {
-    config;
+    inner;
     settingsManager;
-    proxyHandle = null;
     constructor(cwd, settingsManager) {
-        this.config = resolveSandboxConfig(settingsManager.getSandboxSettings(), cwd);
         this.settingsManager = settingsManager;
+        this.inner = new PackageSandboxManager(toPackageConfig(settingsManager), cwd);
     }
-    getConfig() {
-        return this.config;
+    getState() {
+        return this.inner.getState();
     }
-    /** Override the network mode at runtime (e.g., fallback to 'none' on proxy failure). */
     setNetworkMode(mode) {
-        this.config.networkMode = mode;
+        this.inner.setNetworkMode(mode);
+    }
+    async ensureReady() {
+        return this.inner.ensureReady();
+    }
+    wrapCommand(command, cwd) {
+        return this.inner.wrapCommand(command, cwd);
     }
-    /**
-     * Start the network proxy if network mode is 'proxy'.
-     * Must be called before creating sandbox operations.
-     */
     async startProxy(handler) {
-        if (this.config.networkMode !== 'proxy')
-            return;
-        // Deploy the worker script into WSL
-        deployProxyWorker();
         const allowedDomains = this.settingsManager.getSandboxAllowedDomains();
-        this.proxyHandle = await startNetworkProxy({
-            allowedDomains,
+        await this.inner.startProxy(allowedDomains, {
             onDomainCheck: async (domain) => {
                 const choice = await handler.onDomainCheck(domain);
                 if (choice === 'save') {
@@ -43,17 +61,11 @@ export class SandboxManager {
                 if (choice === 'once')
                     return 'once';
                 return false;
-            },
+            }
         });
-        // Store the socket path so buildBwrapArgs can bind-mount it
-        this.config.proxySocketPath = this.proxyHandle.socketPath;
     }
-    /** Stop the proxy worker. */
     stopProxy() {
-        if (this.proxyHandle) {
-            this.proxyHandle.stop();
-            this.proxyHandle = null;
-        }
+        this.inner.stopProxy();
     }
 }
 //# sourceMappingURL=sandbox-manager.js.map

package/dist/custom/sandbox/sandbox-prompt.js

@@ -9,9 +9,9 @@ import { Border } from '../tools/approval.js';
 const APPROVAL_BUTTONS = [
     { label: 'Allow Once', choice: 'once' },
     { label: 'Allow Always', choice: 'save' },
-    { label: 'Deny', choice: 'deny' },
+    { label: 'Deny', choice: 'deny' }
 ];
-export class SandboxPrompt extends Container {
+class SandboxPrompt extends Container {
     selectedButton = 0;
     buttonContainer = new Container();
     theme;