tau-all-agent 0.2.0 → 0.3.1

package/extensions/review/fix.ts

@@ -18,6 +18,7 @@ import {
   REVIEW_CANCELLED_ERROR,
   type AgentEndMessage,
   type AgentEndMessages,
+  type AgentSettledState,
   type FixPassAgentTracker,
   type ReviewRuntime,
 } from "./runtime.js";
@@ -154,8 +155,8 @@ function getLastAssistantMessage(messages: AgentEndMessages): AgentEndMessage |
   return messages.findLast((message) => message?.role === "assistant");
 }
 
-function wasLastAssistantAborted(messages: AgentEndMessages): boolean {
-  return getLastAssistantMessage(messages)?.stopReason === "aborted";
+function wasFixPassAborted(result: AgentSettledState): boolean {
+  return result.aborted || getLastAssistantMessage(result.messages)?.stopReason === "aborted";
 }
 
 async function waitForPromptStartIfImmediate(
@@ -167,13 +168,6 @@ async function waitForPromptStartIfImmediate(
   await agentTracker.waitForStartAfter(startCountBeforePrompt, FIX_PASS_START_GRACE_MS);
 }
 
-async function waitForFixPassCompletion(
-  agentTracker: FixPassAgentTracker,
-): Promise<AgentEndMessages> {
-  await agentTracker.waitForNextSettled();
-  return agentTracker.getLastEnd()?.messages ?? [];
-}
-
 export async function runFixPassFromReview(
   pi: ExtensionAPI,
   ctx: ExtensionCommandContext,
@@ -181,9 +175,9 @@ export async function runFixPassFromReview(
   additionalContext: string | undefined,
   agentTracker: FixPassAgentTracker,
   reviewMessageQueue: ReviewMessageQueue,
-): Promise<AgentEndMessages> {
+): Promise<AgentSettledState> {
   const failedFocusCount = countFailedFocusRuns(reviewDetails);
-  const fixPassFinished = waitForFixPassCompletion(agentTracker);
+  const fixPassFinished = agentTracker.waitForNextSettled();
 
   const startCountBeforeSteering = agentTracker.getStartCount();
   const steeringStartsImmediately = ctx.isIdle();
@@ -200,11 +194,11 @@ export async function runFixPassFromReview(
   });
   await waitForPromptStartIfImmediate(agentTracker, startCountBeforeFix, fixPass.startsImmediately);
 
-  const fixMessages = await fixPassFinished;
-  if (!wasLastAssistantAborted(fixMessages)) {
+  const result = await fixPassFinished;
+  if (!wasFixPassAborted(result)) {
     notifyFixUsedPartialReview(ctx, failedFocusCount);
   }
-  return fixMessages;
+  return result;
 }
 
 export async function runFixLoop(
@@ -220,7 +214,7 @@ export async function runFixLoop(
     if (!reviewDetails) return;
 
     const beforeFixFingerprint = reviewDetails.fingerprint;
-    const fixMessages = await runFixPassFromReview(
+    const result = await runFixPassFromReview(
       pi,
       ctx,
       reviewDetails,
@@ -229,7 +223,7 @@ export async function runFixLoop(
       reviewMessageQueue,
     );
     if (runtime.closed) return;
-    if (wasLastAssistantAborted(fixMessages)) {
+    if (wasFixPassAborted(result)) {
       notify(ctx, "Fix loop stopped: fix pass was aborted.", "warning");
       return;
     }

package/extensions/review/git.ts

@@ -47,7 +47,13 @@ function hashString(value: string): string {
 }
 
 function runGit(context: ReviewCommandContext, args: string[]) {
-  return runReviewCommand(context, "git", args);
+  // Diff can refresh index metadata even when optional locks are disabled.
+  return runReviewCommand(context, "git", [
+    "--no-optional-locks",
+    "-c",
+    "diff.autoRefreshIndex=false",
+    ...args,
+  ]);
 }
 
 export async function isGitRepo(context: ReviewCommandContext): Promise<boolean> {

package/extensions/review/index.ts

@@ -103,8 +103,8 @@ export default function reviewExtension(pi: ExtensionAPI) {
     });
   });
 
-  pi.on("agent_settled", async () => {
-    agentTracker.handleSettled();
+  pi.on("agent_settled", async (event) => {
+    agentTracker.handleSettled(event.aborted);
   });
 
   pi.registerCommand("review", {

package/extensions/review/models.ts

@@ -3,8 +3,8 @@ import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-a
 
 import { REVIEW_TASK_TIMEOUT_MS } from "./runner.js";
 
-const OPENAI_FAST_MODEL_ID = "gpt-5.6-luna";
-const ANTHROPIC_FAST_MODEL_ID = "claude-haiku-4-5";
+const OPENAI_FAST_MODEL_ID = "gpt-6-luna";
+const ANTHROPIC_FAST_MODEL_ID = "claude-haiku-5-5";
 
 type ModelFamily = "openai" | "anthropic";
 
@@ -310,6 +310,16 @@ function createResolvedReviewModel(options: {
   };
 }
 
+// --no-extensions also disables the built-in llama.cpp provider.
+export function buildReviewModelArgs(modelArg: string | undefined): string[] {
+  if (!modelArg) return [];
+  return [
+    "--model",
+    modelArg,
+    ...(/^llama\.cpp\//i.test(modelArg) ? ["--extension", "builtin:llama.cpp"] : []),
+  ];
+}
+
 export function selectReviewDedupModel(ctx: ExtensionContext): { modelArg: string } | null {
   if (!ctx.model) return null;
 

package/extensions/review/review.ts

@@ -54,6 +54,7 @@ import {
   buildResolvedReviewModelLabel,
   buildResolvedReviewStatusModelLabel,
   buildReviewProgressModelLabel,
+  buildReviewModelArgs,
   clearProviderCandidateProbe,
   getFallbackThinkingLevels,
   getProviderCandidateAvailability,
@@ -572,10 +573,8 @@ async function runFocusTaskOnce(
     "--no-skills",
     "--no-prompt-templates",
     "--no-themes",
+    ...buildReviewModelArgs(modelArg),
   ];
-  if (modelArg) {
-    args.push("--model", modelArg);
-  }
 
   const taskResult = await runPiSubmitToolTask({
     args,
@@ -862,8 +861,7 @@ async function runReviewDedupTask(options: {
           "--no-skills",
           "--no-prompt-templates",
           "--no-themes",
-          "--model",
-          model.modelArg,
+          ...buildReviewModelArgs(model.modelArg),
         ],
         prompt: buildReviewDedupPrompt(findings),
         cwd,

package/extensions/review/runtime.ts

@@ -30,17 +30,18 @@ export type AgentEndState = {
   messages: AgentEndMessages;
 };
 
+export type AgentSettledState = AgentEndState & { aborted: boolean };
+
 export type FixPassAgentTracker = {
-  waitForNextSettled: () => Promise<void>;
+  waitForNextSettled: () => Promise<AgentSettledState>;
   waitForStartAfter: (lastSeenStartCount: number, timeoutMs: number) => Promise<boolean>;
   getStartCount: () => number;
-  getLastEnd: () => AgentEndState | undefined;
 };
 
 export type AgentRunTracker = FixPassAgentTracker & {
   handleStart: () => void;
   handleEnd: (state: AgentEndState) => void;
-  handleSettled: () => void;
+  handleSettled: (aborted: boolean) => void;
   reset: () => void;
 };
 
@@ -264,12 +265,12 @@ export function renderReviewProgressHeader(
 }
 
 export function createAgentRunTracker(): AgentRunTracker {
-  let resolveNextAgentSettled: (() => void) | undefined;
+  let resolveNextAgentSettled: ((state: AgentSettledState) => void) | undefined;
   let resolveNextAgentStart: (() => void) | undefined;
   let lastAgentEnd: AgentEndState | undefined;
   let agentStartCount = 0;
 
-  function waitForNextSettled(): Promise<void> {
+  function waitForNextSettled(): Promise<AgentSettledState> {
     return new Promise((resolve) => {
       resolveNextAgentSettled = resolve;
     });
@@ -301,8 +302,8 @@ export function createAgentRunTracker(): AgentRunTracker {
     waitForNextSettled,
     waitForStartAfter,
     getStartCount: () => agentStartCount,
-    getLastEnd: () => lastAgentEnd,
     handleStart: () => {
+      lastAgentEnd = undefined;
       agentStartCount += 1;
       const resolve = resolveNextAgentStart;
       if (!resolve) return;
@@ -312,11 +313,11 @@ export function createAgentRunTracker(): AgentRunTracker {
     handleEnd: (state) => {
       lastAgentEnd = state;
     },
-    handleSettled: () => {
+    handleSettled: (aborted) => {
       const resolve = resolveNextAgentSettled;
       if (!resolve) return;
       resolveNextAgentSettled = undefined;
-      resolve();
+      resolve({ messages: lastAgentEnd?.messages ?? [], aborted });
     },
     reset: () => {
       resolveNextAgentSettled = undefined;

package/extensions/review/triage.ts

@@ -35,6 +35,7 @@ import {
 } from "./git.js";
 import {
   buildResolvedReviewStatusModelLabel,
+  buildReviewModelArgs,
   getResolvedReviewStatusModelArg,
   resolveModels,
   type ResolvedReviewModel,
@@ -451,11 +452,8 @@ async function runTriageTask(options: {
     "--no-skills",
     "--no-prompt-templates",
     "--no-themes",
+    ...buildReviewModelArgs(getResolvedReviewStatusModelArg(model)),
   ];
-  const modelArg = getResolvedReviewStatusModelArg(model);
-  if (modelArg) {
-    args.push("--model", modelArg);
-  }
 
   for (let attempt = 0; ; attempt += 1) {
     signal.throwIfAborted();

package/extensions/sandbox/README.md

@@ -0,0 +1,7 @@
+# Sandbox
+
+Sandboxes Bash commands and their descendants on macOS and Linux, including calls through codemode. Pi itself, other tools, and MCP servers retain host permissions. Run `/sandbox` for help.
+
+Relative filesystem rules and socket paths resolve from the owning session's working directory, including session-only `/sandbox filesystem` changes. Configuration files are not rewritten.
+
+Terminal-status reports may expose approval titles containing commands, paths, or hosts. Disable these reports with `PI_PROGRAM_STATUS=0`.

package/extensions/sandbox/bash.ts

@@ -209,7 +209,7 @@ function maybeAllowGitMetadataWriteForSession(options: {
   applyRuntimeConfigForSession(ctx, nextConfig);
 }
 
-/** Create a single-invocation native backend whose approval covers the resolved spawn context. */
+/** Create a single-invocation native backend that requires fresh human approval. */
 export function createUnsandboxedBashOps(
   runtime: SandboxRuntime,
   sandboxedOps: SandboxedBashOperations,
@@ -243,7 +243,7 @@ export function createUnsandboxedBashOps(
       return sandboxedOps.runSerially(async () => {
         assertAvailable();
         if (options.signal?.aborted) throw new Error("aborted");
-        const title = formatUnsandboxedApproval(command, absoluteCwd);
+        const title = formatUnsandboxedApproval(command);
         let choice: string | undefined;
         try {
           choice = await ctx.ui.select(title, [...UNSANDBOXED_APPROVAL_CHOICES], {
@@ -672,104 +672,102 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
     runSerially,
     async exec(command, cwd, { onData, signal, timeout, env }) {
       validateTimeout(timeout);
-      return runSerially(async () => {
-        if (!existsSync(cwd)) {
-          throw new Error(`Working directory does not exist: ${cwd}`);
-        }
+      if (!existsSync(cwd)) {
+        throw new Error(`Working directory does not exist: ${cwd}`);
+      }
+
+      const attemptStartedAt = Date.now();
+      const initialRun = await prepareAndRunSandboxAttempt({
+        command,
+        cwd,
+        onData,
+        signal,
+        timeout,
+        env,
+      });
+      const retryTimeout = getRemainingTimeout(timeout, attemptStartedAt);
 
-        const attemptStartedAt = Date.now();
-        const initialRun = await prepareAndRunSandboxAttempt({
+      let processedAttempt: ProcessedSandboxAttempt;
+      try {
+        processedAttempt = await processSandboxAttempt({
+          attempt: initialRun.attempt,
           command,
+          commandId: initialRun.commandId,
           cwd,
-          onData,
-          signal,
-          timeout,
-          env,
+          runtimeConfig: initialRun.runtimeConfig,
+          autoRetryAvailable: true,
         });
-        const retryTimeout = getRemainingTimeout(timeout, attemptStartedAt);
+      } catch (postProcessError) {
+        reportPostProcessingError(postProcessError);
+        safeCleanupAfterCommand();
+        return { exitCode: initialRun.attempt.exitCode };
+      }
 
-        let processedAttempt: ProcessedSandboxAttempt;
-        try {
-          processedAttempt = await processSandboxAttempt({
-            attempt: initialRun.attempt,
-            command,
-            commandId: initialRun.commandId,
-            cwd,
-            runtimeConfig: initialRun.runtimeConfig,
-            autoRetryAvailable: true,
-          });
-        } catch (postProcessError) {
-          reportPostProcessingError(postProcessError);
-          safeCleanupAfterCommand();
-          return { exitCode: initialRun.attempt.exitCode };
-        }
+      const retryResolution = processedAttempt.resolution;
+      if (retryResolution?.kind !== "allow-retry") {
+        if (processedAttempt.postamble) onData(Buffer.from(processedAttempt.postamble));
+        safeCleanupAfterCommand();
+        return { exitCode: processedAttempt.exitCode };
+      }
 
-        const retryResolution = processedAttempt.resolution;
-        if (retryResolution?.kind !== "allow-retry") {
-          if (processedAttempt.postamble) onData(Buffer.from(processedAttempt.postamble));
-          safeCleanupAfterCommand();
-          return { exitCode: processedAttempt.exitCode };
-        }
+      if (processedAttempt.postamble) {
+        onData(Buffer.from(ensureTrailingNewline(processedAttempt.postamble)));
+      }
 
-        if (processedAttempt.postamble) {
-          onData(Buffer.from(ensureTrailingNewline(processedAttempt.postamble)));
-        }
+      initialRun.attempt.combinedOutput = "";
+      safeCleanupAfterCommand();
 
-        initialRun.attempt.combinedOutput = "";
-        safeCleanupAfterCommand();
+      if (retryTimeout !== undefined && retryTimeout <= 0) {
+        onData(Buffer.from(retryResolution.retrySkippedMessage));
+        return { exitCode: processedAttempt.exitCode };
+      }
 
-        if (retryTimeout !== undefined && retryTimeout <= 0) {
-          onData(Buffer.from(retryResolution.retrySkippedMessage));
-          return { exitCode: processedAttempt.exitCode };
-        }
+      const retryRun = await prepareAndRunSandboxAttempt({
+        command,
+        cwd,
+        onData,
+        signal,
+        timeout: retryTimeout,
+        env,
+      });
 
-        const retryRun = await prepareAndRunSandboxAttempt({
+      let processedRetry: ProcessedSandboxAttempt;
+      try {
+        processedRetry = await processSandboxAttempt({
+          attempt: retryRun.attempt,
           command,
+          commandId: retryRun.commandId,
           cwd,
-          onData,
-          signal,
-          timeout: retryTimeout,
-          env,
+          runtimeConfig: retryRun.runtimeConfig,
+          autoRetryAvailable: false,
         });
+      } catch (postProcessError) {
+        reportPostProcessingError(postProcessError);
+        safeCleanupAfterCommand();
+        return { exitCode: retryRun.attempt.exitCode };
+      }
 
-        let processedRetry: ProcessedSandboxAttempt;
-        try {
-          processedRetry = await processSandboxAttempt({
-            attempt: retryRun.attempt,
-            command,
-            commandId: retryRun.commandId,
-            cwd,
-            runtimeConfig: retryRun.runtimeConfig,
-            autoRetryAvailable: false,
-          });
-        } catch (postProcessError) {
-          reportPostProcessingError(postProcessError);
-          safeCleanupAfterCommand();
-          return { exitCode: retryRun.attempt.exitCode };
-        }
-
-        let retryPostamble = processedRetry.postamble;
-        if (processedRetry.exitCode === 0) {
-          retryPostamble = appendOutputPostamble(
-            retryPostamble,
-            retryResolution.retrySuccessMessage,
-            retryRun.attempt.combinedOutput,
-          );
-        } else if (
-          !processedRetry.resolution &&
-          processedRetry.runtimeProtectedWriteViolations.length === 0
-        ) {
-          retryPostamble = appendOutputPostamble(
-            retryPostamble,
-            retryResolution.retryFailureMessage,
-            retryRun.attempt.combinedOutput,
-          );
-        }
+      let retryPostamble = processedRetry.postamble;
+      if (processedRetry.exitCode === 0) {
+        retryPostamble = appendOutputPostamble(
+          retryPostamble,
+          retryResolution.retrySuccessMessage,
+          retryRun.attempt.combinedOutput,
+        );
+      } else if (
+        !processedRetry.resolution &&
+        processedRetry.runtimeProtectedWriteViolations.length === 0
+      ) {
+        retryPostamble = appendOutputPostamble(
+          retryPostamble,
+          retryResolution.retryFailureMessage,
+          retryRun.attempt.combinedOutput,
+        );
+      }
 
-        if (retryPostamble) onData(Buffer.from(retryPostamble));
-        safeCleanupAfterCommand();
-        return { exitCode: processedRetry.exitCode };
-      }, signal);
+      if (retryPostamble) onData(Buffer.from(retryPostamble));
+      safeCleanupAfterCommand();
+      return { exitCode: processedRetry.exitCode };
     },
   };
 }

package/extensions/sandbox/command.ts

@@ -5,6 +5,7 @@ import {
   cloneRuntimeConfig,
   escapeSlashCommandArg,
   mutateStringList,
+  resolveSandboxPath,
   type ListOp,
   type PromptMode,
   type SandboxConfigPath,
@@ -585,7 +586,20 @@ export function registerSandboxCommand(pi: ExtensionAPI, runtime: SandboxRuntime
             : list === "allow-write"
               ? nextConfig.filesystem.allowWrite
               : nextConfig.filesystem.denyWrite;
-        const changed = mutateStringList(values, op, targetPath);
+        // Exact runtime entries are already expanded and may contain literal dollars.
+        const resolvedPath = values.includes(targetPath)
+          ? targetPath
+          : resolveSandboxPath(targetPath, `filesystem ${list}`, ctx.cwd);
+        if (resolvedPath === null) {
+          notify(
+            ctx,
+            "Invalid filesystem path: unset or empty environment variable, or control characters",
+            "warning",
+          );
+          return;
+        }
+
+        const changed = mutateStringList(values, op, resolvedPath);
         if (!changed) {
           notify(
             ctx,

package/extensions/sandbox/config.ts

@@ -291,7 +291,7 @@ export function normalizePromptMode(value: unknown): PromptMode {
 
 function expandPath(value: string, cwd?: string): string {
   const expanded =
-    value === "~" ? homedir() : value.startsWith("~/") ? join(homedir(), value.slice(2)) : value;
+    value === "~" ? homedir() : value.startsWith("~/") ? homedir() + value.slice(1) : value;
   return cwd && !expanded.startsWith("/") ? resolve(cwd, expanded) : expanded;
 }
 
@@ -570,7 +570,7 @@ function containsControlCharacter(value: string): boolean {
   return false;
 }
 
-function expandPathConfigEntry(value: string, field: string): string | null {
+export function resolveSandboxPath(value: string, field: string, cwd: string): string | null {
   const source = value.trim();
   if (!source) return null;
 
@@ -605,24 +605,29 @@ function expandPathConfigEntry(value: string, field: string): string | null {
     return null;
   }
 
-  return expanded;
+  return expandPath(expanded, cwd);
 }
 
-function expandPathConfigList(values: string[] | undefined, field: string): string[] | undefined {
+function expandPathConfigList(
+  values: string[] | undefined,
+  field: string,
+  cwd: string,
+): string[] | undefined {
   if (!values) return undefined;
 
   return values
-    .map((value) => expandPathConfigEntry(value, field))
+    .map((value) => resolveSandboxPath(value, field, cwd))
     .filter((value): value is string => value !== null);
 }
 
 function expandMitmProxyPathConfig(
   mitmProxy: SandboxRuntimeConfig["network"]["mitmProxy"],
+  cwd: string,
 ): SandboxRuntimeConfig["network"]["mitmProxy"] {
   if (!mitmProxy) return undefined;
   if (!isPlainObject(mitmProxy) || typeof mitmProxy.socketPath !== "string") return mitmProxy;
 
-  const socketPath = expandPathConfigEntry(mitmProxy.socketPath, "network.mitmProxy.socketPath");
+  const socketPath = resolveSandboxPath(mitmProxy.socketPath, "network.mitmProxy.socketPath", cwd);
   if (!socketPath) {
     console.error("Warning: Disabling network.mitmProxy because its socketPath did not expand.");
     return undefined;
@@ -633,30 +638,36 @@ function expandMitmProxyPathConfig(
 
 function expandNetworkPathConfig(
   network: SandboxRuntimeConfig["network"],
+  cwd: string,
 ): SandboxRuntimeConfig["network"] {
   return {
     ...network,
-    allowUnixSockets: expandPathConfigList(network.allowUnixSockets, "network.allowUnixSockets"),
-    mitmProxy: expandMitmProxyPathConfig(network.mitmProxy),
+    allowUnixSockets: expandPathConfigList(
+      network.allowUnixSockets,
+      "network.allowUnixSockets",
+      cwd,
+    ),
+    mitmProxy: expandMitmProxyPathConfig(network.mitmProxy, cwd),
   };
 }
 
 function expandFilesystemPathConfig(
   filesystem: SandboxRuntimeConfig["filesystem"],
+  cwd: string,
 ): SandboxRuntimeConfig["filesystem"] {
   return {
     ...filesystem,
-    denyRead: expandPathConfigList(filesystem.denyRead, "filesystem.denyRead") ?? [],
-    allowRead: expandPathConfigList(filesystem.allowRead, "filesystem.allowRead"),
-    allowWrite: expandPathConfigList(filesystem.allowWrite, "filesystem.allowWrite") ?? [],
-    denyWrite: expandPathConfigList(filesystem.denyWrite, "filesystem.denyWrite") ?? [],
+    denyRead: expandPathConfigList(filesystem.denyRead, "filesystem.denyRead", cwd) ?? [],
+    allowRead: expandPathConfigList(filesystem.allowRead, "filesystem.allowRead", cwd),
+    allowWrite: expandPathConfigList(filesystem.allowWrite, "filesystem.allowWrite", cwd) ?? [],
+    denyWrite: expandPathConfigList(filesystem.denyWrite, "filesystem.denyWrite", cwd) ?? [],
   };
 }
 
-export function toRuntimeConfig(config: SandboxConfig): SandboxRuntimeConfig {
+export function toRuntimeConfig(config: SandboxConfig, cwd: string): SandboxRuntimeConfig {
   const { allowGitCommonDir: _allowGitCommonDir, allowTempDirs, ...filesystem } = config.filesystem;
-  const expandedNetwork = expandNetworkPathConfig(config.network);
-  const expandedFilesystem = expandFilesystemPathConfig(filesystem);
+  const expandedNetwork = expandNetworkPathConfig(config.network, cwd);
+  const expandedFilesystem = expandFilesystemPathConfig(filesystem, cwd);
   const allowWrite = allowTempDirs
     ? [...expandedFilesystem.allowWrite, ...getTemporaryWritePaths()]
     : expandedFilesystem.allowWrite;

package/extensions/sandbox/index.ts

@@ -63,7 +63,7 @@ import { Type } from "typebox";
 
 import { createSandboxedBashOps, createUnsandboxedBashOps } from "./bash.js";
 import { registerSandboxCommand } from "./command.js";
-import { isUnsandboxedApproval, showUnsandboxedApproval } from "./permissions/unsandboxed.js";
+import { isUnsandboxedApproval } from "./permissions/unsandboxed.js";
 import { createSandboxRuntime, getSandboxRunMode } from "./runtime.js";
 
 export default function sandboxExtension(pi: ExtensionAPI): void {
@@ -102,6 +102,7 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
       .withPermissionContext(ctx, request.signal, async (_ctx, signal) => {
         if (
           !ctx.hasUI ||
+          !["tui", "rpc"].includes(ctx.mode) ||
           runtime.state.status !== "active" ||
           runtime.promptMode !== "interactive"
         ) {
@@ -109,12 +110,7 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
         }
         // The subagent already owns the parent's permission queue. Use the original UI,
         // not the invocation wrapper, to avoid recursively entering that queue.
-        const choice =
-          ctx.mode === "tui"
-            ? await showUnsandboxedApproval(ctx, title, signal)
-            : ctx.mode === "rpc"
-              ? await ctx.ui.select(title, choices, { signal })
-              : undefined;
+        const choice = await ctx.ui.select(title, choices, { signal });
         return signal.aborted ||
           runtime.state.status !== "active" ||
           runtime.promptMode !== "interactive"
@@ -155,8 +151,6 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
   });
 
   const localBashTool = createBashToolDefinition(process.cwd());
-  const sandboxedBashTool = createBashToolDefinition(process.cwd(), { operations: sandboxedOps });
-
   pi.registerTool({
     ...localBashTool,
     label: "bash (sandbox-aware)",
@@ -222,8 +216,24 @@ export default function sandboxExtension(pi: ExtensionAPI): void {
         return localBashTool.execute(id, params, signal, onUpdate, ctx);
       }
 
-      runtime.captureContext(ctx);
-      return sandboxedBashTool.execute(id, params, signal, onUpdate, ctx);
+      return runtime.withPermissionContext(ctx, signal, (invocationContext, invocationSignal) => {
+        const tool = createBashToolDefinition(ctx.cwd, {
+          operations: {
+            exec(command, cwd, options) {
+              return sandboxedOps.runSerially(
+                () =>
+                  runtime.withBashContext(ctx, invocationSignal, async () => {
+                    const result = await sandboxedOps.exec(command, cwd, options);
+                    if (invocationSignal.aborted) throw new Error("aborted");
+                    return result;
+                  }),
+                invocationSignal,
+              );
+            },
+          },
+        });
+        return tool.execute(id, params, invocationSignal, onUpdate, invocationContext);
+      });
     },
   });