subagent-cli 0.2.9 → 0.3.1

package/src/entrypoints/init.ts

@@ -1,340 +0,0 @@
-import { profileCheckpoint } from '../utils/startupProfiler.js'
-import '../bootstrap/state.js'
-import '../utils/config.js'
-import type { Attributes, MetricOptions } from '@opentelemetry/api'
-import memoize from 'lodash-es/memoize.js'
-import { getIsNonInteractiveSession } from 'src/bootstrap/state.js'
-import type { AttributedCounter } from '../bootstrap/state.js'
-import { getSessionCounter, setMeter } from '../bootstrap/state.js'
-import { shutdownLspServerManager } from '../services/lsp/manager.js'
-import { populateOAuthAccountInfoIfNeeded } from '../services/oauth/client.js'
-import {
-  initializePolicyLimitsLoadingPromise,
-  isPolicyLimitsEligible,
-} from '../services/policyLimits/index.js'
-import {
-  initializeRemoteManagedSettingsLoadingPromise,
-  isEligibleForRemoteManagedSettings,
-  waitForRemoteManagedSettingsToLoad,
-} from '../services/remoteManagedSettings/index.js'
-import { preconnectAnthropicApi } from '../utils/apiPreconnect.js'
-import { applyExtraCACertsFromConfig } from '../utils/caCertsConfig.js'
-import { registerCleanup } from '../utils/cleanupRegistry.js'
-import { enableConfigs, recordFirstStartTime } from '../utils/config.js'
-import { logForDebugging } from '../utils/debug.js'
-import { detectCurrentRepository } from '../utils/detectRepository.js'
-import { logForDiagnosticsNoPII } from '../utils/diagLogs.js'
-import { initJetBrainsDetection } from '../utils/envDynamic.js'
-import { isEnvTruthy } from '../utils/envUtils.js'
-import { ConfigParseError, errorMessage } from '../utils/errors.js'
-// showInvalidConfigDialog is dynamically imported in the error path to avoid loading React at init
-import {
-  gracefulShutdownSync,
-  setupGracefulShutdown,
-} from '../utils/gracefulShutdown.js'
-import {
-  applyConfigEnvironmentVariables,
-  applySafeConfigEnvironmentVariables,
-} from '../utils/managedEnv.js'
-import { configureGlobalMTLS } from '../utils/mtls.js'
-import {
-  ensureScratchpadDir,
-  isScratchpadEnabled,
-} from '../utils/permissions/filesystem.js'
-// initializeTelemetry is loaded lazily via import() in setMeterState() to defer
-// ~400KB of OpenTelemetry + protobuf modules until telemetry is actually initialized.
-// gRPC exporters (~700KB via @grpc/grpc-js) are further lazy-loaded within instrumentation.ts.
-import { configureGlobalAgents } from '../utils/proxy.js'
-import { isBetaTracingEnabled } from '../utils/telemetry/betaSessionTracing.js'
-import { getTelemetryAttributes } from '../utils/telemetryAttributes.js'
-import { setShellIfWindows } from '../utils/windowsPaths.js'
-
-// initialize1PEventLogging is dynamically imported to defer OpenTelemetry sdk-logs/resources
-
-// Track if telemetry has been initialized to prevent double initialization
-let telemetryInitialized = false
-
-export const init = memoize(async (): Promise<void> => {
-  const initStartTime = Date.now()
-  logForDiagnosticsNoPII('info', 'init_started')
-  profileCheckpoint('init_function_start')
-
-  // Validate configs are valid and enable configuration system
-  try {
-    const configsStart = Date.now()
-    enableConfigs()
-    logForDiagnosticsNoPII('info', 'init_configs_enabled', {
-      duration_ms: Date.now() - configsStart,
-    })
-    profileCheckpoint('init_configs_enabled')
-
-    // Apply only safe environment variables before trust dialog
-    // Full environment variables are applied after trust is established
-    const envVarsStart = Date.now()
-    applySafeConfigEnvironmentVariables()
-
-    // Apply NODE_EXTRA_CA_CERTS from settings.json to process.env early,
-    // before any TLS connections. Bun caches the TLS cert store at boot
-    // via BoringSSL, so this must happen before the first TLS handshake.
-    applyExtraCACertsFromConfig()
-
-    logForDiagnosticsNoPII('info', 'init_safe_env_vars_applied', {
-      duration_ms: Date.now() - envVarsStart,
-    })
-    profileCheckpoint('init_safe_env_vars_applied')
-
-    // Make sure things get flushed on exit
-    setupGracefulShutdown()
-    profileCheckpoint('init_after_graceful_shutdown')
-
-    // Initialize 1P event logging (no security concerns, but deferred to avoid
-    // loading OpenTelemetry sdk-logs at startup). growthbook.js is already in
-    // the module cache by this point (firstPartyEventLogger imports it), so the
-    // second dynamic import adds no load cost.
-    void Promise.all([
-      import('../services/analytics/firstPartyEventLogger.js'),
-      import('../services/analytics/growthbook.js'),
-    ]).then(([fp, gb]) => {
-      fp.initialize1PEventLogging()
-      // Rebuild the logger provider if tengu_1p_event_batch_config changes
-      // mid-session. Change detection (isEqual) is inside the handler so
-      // unchanged refreshes are no-ops.
-      gb.onGrowthBookRefresh(() => {
-        void fp.reinitialize1PEventLoggingIfConfigChanged()
-      })
-    })
-    profileCheckpoint('init_after_1p_event_logging')
-
-    // Populate OAuth account info if it is not already cached in config. This is needed since the
-    // OAuth account info may not be populated when logging in through the VSCode extension.
-    void populateOAuthAccountInfoIfNeeded()
-    profileCheckpoint('init_after_oauth_populate')
-
-    // Initialize JetBrains IDE detection asynchronously (populates cache for later sync access)
-    void initJetBrainsDetection()
-    profileCheckpoint('init_after_jetbrains_detection')
-
-    // Detect GitHub repository asynchronously (populates cache for gitDiff PR linking)
-    void detectCurrentRepository()
-
-    // Initialize the loading promise early so that other systems (like plugin hooks)
-    // can await remote settings loading. The promise includes a timeout to prevent
-    // deadlocks if loadRemoteManagedSettings() is never called (e.g., Agent SDK tests).
-    if (isEligibleForRemoteManagedSettings()) {
-      initializeRemoteManagedSettingsLoadingPromise()
-    }
-    if (isPolicyLimitsEligible()) {
-      initializePolicyLimitsLoadingPromise()
-    }
-    profileCheckpoint('init_after_remote_settings_check')
-
-    // Record the first start time
-    recordFirstStartTime()
-
-    // Configure global mTLS settings
-    const mtlsStart = Date.now()
-    logForDebugging('[init] configureGlobalMTLS starting')
-    configureGlobalMTLS()
-    logForDiagnosticsNoPII('info', 'init_mtls_configured', {
-      duration_ms: Date.now() - mtlsStart,
-    })
-    logForDebugging('[init] configureGlobalMTLS complete')
-
-    // Configure global HTTP agents (proxy and/or mTLS)
-    const proxyStart = Date.now()
-    logForDebugging('[init] configureGlobalAgents starting')
-    configureGlobalAgents()
-    logForDiagnosticsNoPII('info', 'init_proxy_configured', {
-      duration_ms: Date.now() - proxyStart,
-    })
-    logForDebugging('[init] configureGlobalAgents complete')
-    profileCheckpoint('init_network_configured')
-
-    // Preconnect to the Anthropic API — overlap TCP+TLS handshake
-    // (~100-200ms) with the ~100ms of action-handler work before the API
-    // request. After CA certs + proxy agents are configured so the warmed
-    // connection uses the right transport. Fire-and-forget; skipped for
-    // proxy/mTLS/unix/cloud-provider where the SDK's dispatcher wouldn't
-    // reuse the global pool.
-    preconnectAnthropicApi()
-
-    // CCR upstreamproxy: start the local CONNECT relay so agent subprocesses
-    // can reach org-configured upstreams with credential injection. Gated on
-    // CLAUDE_CODE_REMOTE + GrowthBook; fail-open on any error. Lazy import so
-    // non-CCR startups don't pay the module load. The getUpstreamProxyEnv
-    // function is registered with subprocessEnv.ts so subprocess spawning can
-    // inject proxy vars without a static import of the upstreamproxy module.
-    if (isEnvTruthy(process.env.CLAUDE_CODE_REMOTE)) {
-      try {
-        const { initUpstreamProxy, getUpstreamProxyEnv } = await import(
-          '../upstreamproxy/upstreamproxy.js'
-        )
-        const { registerUpstreamProxyEnvFn } = await import(
-          '../utils/subprocessEnv.js'
-        )
-        registerUpstreamProxyEnvFn(getUpstreamProxyEnv)
-        await initUpstreamProxy()
-      } catch (err) {
-        logForDebugging(
-          `[init] upstreamproxy init failed: ${err instanceof Error ? err.message : String(err)}; continuing without proxy`,
-          { level: 'warn' },
-        )
-      }
-    }
-
-    // Set up git-bash if relevant
-    setShellIfWindows()
-
-    // Register LSP manager cleanup (initialization happens in main.tsx after --plugin-dir is processed)
-    registerCleanup(shutdownLspServerManager)
-
-    // gh-32730: teams created by subagents (or main agent without
-    // explicit TeamDelete) were left on disk forever. Register cleanup
-    // for all teams created this session. Lazy import: swarm code is
-    // behind feature gate and most sessions never create teams.
-    registerCleanup(async () => {
-      const { cleanupSessionTeams } = await import(
-        '../utils/swarm/teamHelpers.js'
-      )
-      await cleanupSessionTeams()
-    })
-
-    // Initialize scratchpad directory if enabled
-    if (isScratchpadEnabled()) {
-      const scratchpadStart = Date.now()
-      await ensureScratchpadDir()
-      logForDiagnosticsNoPII('info', 'init_scratchpad_created', {
-        duration_ms: Date.now() - scratchpadStart,
-      })
-    }
-
-    logForDiagnosticsNoPII('info', 'init_completed', {
-      duration_ms: Date.now() - initStartTime,
-    })
-    profileCheckpoint('init_function_end')
-  } catch (error) {
-    if (error instanceof ConfigParseError) {
-      // Skip the interactive Ink dialog when we can't safely render it.
-      // The dialog breaks JSON consumers (e.g. desktop marketplace plugin
-      // manager running `plugin marketplace list --json` in a VM sandbox).
-      if (getIsNonInteractiveSession()) {
-        process.stderr.write(
-          `Configuration error in ${error.filePath}: ${error.message}\n`,
-        )
-        gracefulShutdownSync(1)
-        return
-      }
-
-      // Show the invalid config dialog with the error object and wait for it to complete
-      return import('../components/InvalidConfigDialog.js').then(m =>
-        m.showInvalidConfigDialog({ error }),
-      )
-      // Dialog itself handles process.exit, so we don't need additional cleanup here
-    } else {
-      // For non-config errors, rethrow them
-      throw error
-    }
-  }
-})
-
-/**
- * Initialize telemetry after trust has been granted.
- * For remote-settings-eligible users, waits for settings to load (non-blocking),
- * then re-applies env vars (to include remote settings) before initializing telemetry.
- * For non-eligible users, initializes telemetry immediately.
- * This should only be called once, after the trust dialog has been accepted.
- */
-export function initializeTelemetryAfterTrust(): void {
-  if (isEligibleForRemoteManagedSettings()) {
-    // For SDK/headless mode with beta tracing, initialize eagerly first
-    // to ensure the tracer is ready before the first query runs.
-    // The async path below will still run but doInitializeTelemetry() guards against double init.
-    if (getIsNonInteractiveSession() && isBetaTracingEnabled()) {
-      void doInitializeTelemetry().catch(error => {
-        logForDebugging(
-          `[3P telemetry] Eager telemetry init failed (beta tracing): ${errorMessage(error)}`,
-          { level: 'error' },
-        )
-      })
-    }
-    logForDebugging(
-      '[3P telemetry] Waiting for remote managed settings before telemetry init',
-    )
-    void waitForRemoteManagedSettingsToLoad()
-      .then(async () => {
-        logForDebugging(
-          '[3P telemetry] Remote managed settings loaded, initializing telemetry',
-        )
-        // Re-apply env vars to pick up remote settings before initializing telemetry.
-        applyConfigEnvironmentVariables()
-        await doInitializeTelemetry()
-      })
-      .catch(error => {
-        logForDebugging(
-          `[3P telemetry] Telemetry init failed (remote settings path): ${errorMessage(error)}`,
-          { level: 'error' },
-        )
-      })
-  } else {
-    void doInitializeTelemetry().catch(error => {
-      logForDebugging(
-        `[3P telemetry] Telemetry init failed: ${errorMessage(error)}`,
-        { level: 'error' },
-      )
-    })
-  }
-}
-
-async function doInitializeTelemetry(): Promise<void> {
-  if (telemetryInitialized) {
-    // Already initialized, nothing to do
-    return
-  }
-
-  // Set flag before init to prevent double initialization
-  telemetryInitialized = true
-  try {
-    await setMeterState()
-  } catch (error) {
-    // Reset flag on failure so subsequent calls can retry
-    telemetryInitialized = false
-    throw error
-  }
-}
-
-async function setMeterState(): Promise<void> {
-  // Lazy-load instrumentation to defer ~400KB of OpenTelemetry + protobuf
-  const { initializeTelemetry } = await import(
-    '../utils/telemetry/instrumentation.js'
-  )
-  // Initialize customer OTLP telemetry (metrics, logs, traces)
-  const meter = await initializeTelemetry()
-  if (meter) {
-    // Create factory function for attributed counters
-    const createAttributedCounter = (
-      name: string,
-      options: MetricOptions,
-    ): AttributedCounter => {
-      const counter = meter?.createCounter(name, options)
-
-      return {
-        add(value: number, additionalAttributes: Attributes = {}) {
-          // Always fetch fresh telemetry attributes to ensure they're up to date
-          const currentAttributes = getTelemetryAttributes()
-          const mergedAttributes = {
-            ...currentAttributes,
-            ...additionalAttributes,
-          }
-          counter?.add(value, mergedAttributes)
-        },
-      }
-    }
-
-    setMeter(meter, createAttributedCounter)
-
-    // Increment session counter here because the startup telemetry path
-    // runs before this async initialization completes, so the counter
-    // would be null there.
-    getSessionCounter()?.add(1)
-  }
-}

package/src/entrypoints/mcp.ts

@@ -1,196 +0,0 @@
-import { Server } from '@modelcontextprotocol/sdk/server/index.js'
-import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js'
-import {
-  CallToolRequestSchema,
-  type CallToolResult,
-  ListToolsRequestSchema,
-  type ListToolsResult,
-  type Tool,
-} from '@modelcontextprotocol/sdk/types.js'
-import { getDefaultAppState } from 'src/state/AppStateStore.js'
-import review from '../commands/review.js'
-import type { Command } from '../commands.js'
-import {
-  findToolByName,
-  getEmptyToolPermissionContext,
-  type ToolUseContext,
-} from '../Tool.js'
-import { getTools } from '../tools.js'
-import { createAbortController } from '../utils/abortController.js'
-import { createFileStateCacheWithSizeLimit } from '../utils/fileStateCache.js'
-import { logError } from '../utils/log.js'
-import { createAssistantMessage } from '../utils/messages.js'
-import { getMainLoopModel } from '../utils/model/model.js'
-import { hasPermissionsToUseTool } from '../utils/permissions/permissions.js'
-import { setCwd } from '../utils/Shell.js'
-import { jsonStringify } from '../utils/slowOperations.js'
-import { getErrorParts } from '../utils/toolErrors.js'
-import { zodToJsonSchema } from '../utils/zodToJsonSchema.js'
-
-type ToolInput = Tool['inputSchema']
-type ToolOutput = Tool['outputSchema']
-
-const MCP_COMMANDS: Command[] = [review]
-
-export async function startMCPServer(
-  cwd: string,
-  debug: boolean,
-  verbose: boolean,
-): Promise<void> {
-  // Use size-limited LRU cache for readFileState to prevent unbounded memory growth
-  // 100 files and 25MB limit should be sufficient for MCP server operations
-  const READ_FILE_STATE_CACHE_SIZE = 100
-  const readFileStateCache = createFileStateCacheWithSizeLimit(
-    READ_FILE_STATE_CACHE_SIZE,
-  )
-  setCwd(cwd)
-  const server = new Server(
-    {
-      name: 'claude/tengu',
-      version: MACRO.VERSION,
-    },
-    {
-      capabilities: {
-        tools: {},
-      },
-    },
-  )
-
-  server.setRequestHandler(
-    ListToolsRequestSchema,
-    async (): Promise<ListToolsResult> => {
-      // TODO: Also re-expose any MCP tools
-      const toolPermissionContext = getEmptyToolPermissionContext()
-      const tools = getTools(toolPermissionContext)
-      return {
-        tools: await Promise.all(
-          tools.map(async tool => {
-            let outputSchema: ToolOutput | undefined
-            if (tool.outputSchema) {
-              const convertedSchema = zodToJsonSchema(tool.outputSchema)
-              // MCP SDK requires outputSchema to have type: "object" at root level
-              // Skip schemas with anyOf/oneOf at root (from z.union, z.discriminatedUnion, etc.)
-              // See: https://github.com/anthropics/claude-code/issues/8014
-              if (
-                typeof convertedSchema === 'object' &&
-                convertedSchema !== null &&
-                'type' in convertedSchema &&
-                convertedSchema.type === 'object'
-              ) {
-                outputSchema = convertedSchema as ToolOutput
-              }
-            }
-            return {
-              ...tool,
-              description: await tool.prompt({
-                getToolPermissionContext: async () => toolPermissionContext,
-                tools,
-                agents: [],
-              }),
-              inputSchema: zodToJsonSchema(tool.inputSchema) as ToolInput,
-              outputSchema,
-            }
-          }),
-        ),
-      }
-    },
-  )
-
-  server.setRequestHandler(
-    CallToolRequestSchema,
-    async ({ params: { name, arguments: args } }): Promise<CallToolResult> => {
-      const toolPermissionContext = getEmptyToolPermissionContext()
-      // TODO: Also re-expose any MCP tools
-      const tools = getTools(toolPermissionContext)
-      const tool = findToolByName(tools, name)
-      if (!tool) {
-        throw new Error(`Tool ${name} not found`)
-      }
-
-      // Assume MCP servers do not read messages separately from the tool
-      // call arguments.
-      const toolUseContext: ToolUseContext = {
-        abortController: createAbortController(),
-        options: {
-          commands: MCP_COMMANDS,
-          tools,
-          mainLoopModel: getMainLoopModel(),
-          thinkingConfig: { type: 'disabled' },
-          mcpClients: [],
-          mcpResources: {},
-          isNonInteractiveSession: true,
-          debug,
-          verbose,
-          agentDefinitions: { activeAgents: [], allAgents: [] },
-        },
-        getAppState: () => getDefaultAppState(),
-        setAppState: () => {},
-        messages: [],
-        readFileState: readFileStateCache,
-        setInProgressToolUseIDs: () => {},
-        setResponseLength: () => {},
-        updateFileHistoryState: () => {},
-        updateAttributionState: () => {},
-      }
-
-      // TODO: validate input types with zod
-      try {
-        if (!tool.isEnabled()) {
-          throw new Error(`Tool ${name} is not enabled`)
-        }
-        const validationResult = await tool.validateInput?.(
-          (args as never) ?? {},
-          toolUseContext,
-        )
-        if (validationResult && !validationResult.result) {
-          throw new Error(
-            `Tool ${name} input is invalid: ${validationResult.message}`,
-          )
-        }
-        const finalResult = await tool.call(
-          (args ?? {}) as never,
-          toolUseContext,
-          hasPermissionsToUseTool,
-          createAssistantMessage({
-            content: [],
-          }),
-        )
-
-        return {
-          content: [
-            {
-              type: 'text' as const,
-              text:
-                typeof finalResult === 'string'
-                  ? finalResult
-                  : jsonStringify(finalResult.data),
-            },
-          ],
-        }
-      } catch (error) {
-        logError(error)
-
-        const parts =
-          error instanceof Error ? getErrorParts(error) : [String(error)]
-        const errorText = parts.filter(Boolean).join('\n').trim() || 'Error'
-
-        return {
-          isError: true,
-          content: [
-            {
-              type: 'text',
-              text: errorText,
-            },
-          ],
-        }
-      }
-    },
-  )
-
-  async function runServer() {
-    const transport = new StdioServerTransport()
-    await server.connect(transport)
-  }
-
-  return await runServer()
-}

package/src/entrypoints/sandboxTypes.ts

@@ -1,156 +0,0 @@
-/**
- * Sandbox types for the Claude Code Agent SDK
- *
- * This file is the single source of truth for sandbox configuration types.
- * Both the SDK and the settings validation import from here.
- */
-
-import { z } from 'zod/v4'
-import { lazySchema } from '../utils/lazySchema.js'
-
-/**
- * Network configuration schema for sandbox.
- */
-export const SandboxNetworkConfigSchema = lazySchema(() =>
-  z
-    .object({
-      allowedDomains: z.array(z.string()).optional(),
-      allowManagedDomainsOnly: z
-        .boolean()
-        .optional()
-        .describe(
-          'When true (and set in managed settings), only allowedDomains and WebFetch(domain:...) allow rules from managed settings are respected. ' +
-            'User, project, local, and flag settings domains are ignored. Denied domains are still respected from all sources.',
-        ),
-      allowUnixSockets: z
-        .array(z.string())
-        .optional()
-        .describe(
-          'macOS only: Unix socket paths to allow. Ignored on Linux (seccomp cannot filter by path).',
-        ),
-      allowAllUnixSockets: z
-        .boolean()
-        .optional()
-        .describe(
-          'If true, allow all Unix sockets (disables blocking on both platforms).',
-        ),
-      allowLocalBinding: z.boolean().optional(),
-      httpProxyPort: z.number().optional(),
-      socksProxyPort: z.number().optional(),
-    })
-    .optional(),
-)
-
-/**
- * Filesystem configuration schema for sandbox.
- */
-export const SandboxFilesystemConfigSchema = lazySchema(() =>
-  z
-    .object({
-      allowWrite: z
-        .array(z.string())
-        .optional()
-        .describe(
-          'Additional paths to allow writing within the sandbox. ' +
-            'Merged with paths from Edit(...) allow permission rules.',
-        ),
-      denyWrite: z
-        .array(z.string())
-        .optional()
-        .describe(
-          'Additional paths to deny writing within the sandbox. ' +
-            'Merged with paths from Edit(...) deny permission rules.',
-        ),
-      denyRead: z
-        .array(z.string())
-        .optional()
-        .describe(
-          'Additional paths to deny reading within the sandbox. ' +
-            'Merged with paths from Read(...) deny permission rules.',
-        ),
-      allowRead: z
-        .array(z.string())
-        .optional()
-        .describe(
-          'Paths to re-allow reading within denyRead regions. ' +
-            'Takes precedence over denyRead for matching paths.',
-        ),
-      allowManagedReadPathsOnly: z
-        .boolean()
-        .optional()
-        .describe(
-          'When true (set in managed settings), only allowRead paths from policySettings are used.',
-        ),
-    })
-    .optional(),
-)
-
-/**
- * Sandbox settings schema.
- */
-export const SandboxSettingsSchema = lazySchema(() =>
-  z
-    .object({
-      enabled: z.boolean().optional(),
-      failIfUnavailable: z
-        .boolean()
-        .optional()
-        .describe(
-          'Exit with an error at startup if sandbox.enabled is true but the sandbox cannot start ' +
-            '(missing dependencies, unsupported platform, or platform not in enabledPlatforms). ' +
-            'When false (default), a warning is shown and commands run unsandboxed. ' +
-            'Intended for managed-settings deployments that require sandboxing as a hard gate.',
-        ),
-      // Note: enabledPlatforms is an undocumented setting read via .passthrough()
-      // It restricts sandboxing to specific platforms (e.g., ["macos"]).
-      //
-      // Added to unblock NVIDIA enterprise rollout: they want to enable
-      // autoAllowBashIfSandboxed but only on macOS initially, since Linux/WSL
-      // sandbox support is newer and less battle-tested. This allows them to
-      // set enabledPlatforms: ["macos"] to disable sandbox (and auto-allow)
-      // on other platforms until they're ready to expand.
-      autoAllowBashIfSandboxed: z.boolean().optional(),
-      allowUnsandboxedCommands: z
-        .boolean()
-        .optional()
-        .describe(
-          'Allow commands to run outside the sandbox via the dangerouslyDisableSandbox parameter. ' +
-            'When false, the dangerouslyDisableSandbox parameter is completely ignored and all commands must run sandboxed. ' +
-            'Default: true.',
-        ),
-      network: SandboxNetworkConfigSchema(),
-      filesystem: SandboxFilesystemConfigSchema(),
-      ignoreViolations: z.record(z.string(), z.array(z.string())).optional(),
-      enableWeakerNestedSandbox: z.boolean().optional(),
-      enableWeakerNetworkIsolation: z
-        .boolean()
-        .optional()
-        .describe(
-          'macOS only: Allow access to com.apple.trustd.agent in the sandbox. ' +
-            'Needed for Go-based CLI tools (gh, gcloud, terraform, etc.) to verify TLS certificates ' +
-            'when using httpProxyPort with a MITM proxy and custom CA. ' +
-            '**Reduces security** — opens a potential data exfiltration vector through the trustd service. Default: false',
-        ),
-      excludedCommands: z.array(z.string()).optional(),
-      ripgrep: z
-        .object({
-          command: z.string(),
-          args: z.array(z.string()).optional(),
-        })
-        .optional()
-        .describe('Custom ripgrep configuration for bundled ripgrep support'),
-    })
-    .passthrough(),
-)
-
-// Inferred types from schemas
-export type SandboxSettings = z.infer<ReturnType<typeof SandboxSettingsSchema>>
-export type SandboxNetworkConfig = NonNullable<
-  z.infer<ReturnType<typeof SandboxNetworkConfigSchema>>
->
-export type SandboxFilesystemConfig = NonNullable<
-  z.infer<ReturnType<typeof SandboxFilesystemConfigSchema>>
->
-export type SandboxIgnoreViolations = NonNullable<
-  SandboxSettings['ignoreViolations']
->