tau-all-agent 0.3.0 → 0.4.0

package/extensions/sandbox/bash.ts

@@ -1,44 +1,37 @@
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { SandboxManager, type SandboxRuntimeConfig } from "@anthropic-ai/sandbox-runtime";
-import {
-  createLocalBashOperations,
-  type BashOperations,
-  type ExtensionContext,
-} from "@earendil-works/pi-coding-agent";
+import { SandboxManager } from "@anthropic-ai/sandbox-runtime";
+import type { BashOperations, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import {
   cloneRuntimeConfig,
   inferSandboxRuleMatch,
   isSandboxWritablePath,
   mutateStringList,
-  type PromptMode,
   type SandboxConfig,
+  type SandboxPolicy,
 } from "./config.js";
 import type { PermissionResolution } from "./permissions/dialog.js";
 import {
   detectFilesystemViolationFromLine,
+  detectFilesystemViolations,
   extractAppendedSandboxAnnotation,
   formatRuntimeProtectedWriteNotice,
   formatTraversalNotice,
   getRuntimeProtectedWriteViolations,
   getTraversalPaths,
-  handleFilesystemViolation,
+  proposeFilesystemPermission,
   isRuntimeProtectedWriteViolation,
   isTraversalViolation,
   type FilesystemViolation,
 } from "./permissions/filesystem.js";
 import {
   detectMachLookupViolations,
-  handleMachLookupViolation,
+  proposeMachLookupPermission,
 } from "./permissions/mach-lookup.js";
-import {
-  formatUnsandboxedApproval,
-  UNSANDBOXED_APPROVAL_CHOICES,
-} from "./permissions/unsandboxed.js";
-import { notify, type SandboxEvent, type SandboxRuntime } from "./runtime.js";
+import { notify, type SandboxEvent } from "./runtime.js";
+import type { PermissionProposal, TemporaryPermissionGrant } from "./permissions/proposal.js";
 
 const IS_MACOS = process.platform === "darwin";
 const MACOS_SANDBOX_SHELL = fileURLToPath(new URL("./macos-sandbox-shell.mjs", import.meta.url));
@@ -87,12 +80,13 @@ function resolveGitFilesystemPaths(cwd: string): GitFilesystemPaths | null {
 }
 
 function maybeAddGitMetadataWritePath(
-  runtimeConfig: SandboxRuntimeConfig,
+  runtimeConfig: SandboxPolicy,
   path: string,
   cwd?: string,
-): SandboxRuntimeConfig | null {
+): SandboxPolicy | null {
   if (isSandboxWritablePath(runtimeConfig, path, cwd)) return null;
-  if (inferSandboxRuleMatch(path, runtimeConfig.filesystem.denyWrite, cwd)) return null;
+  if (inferSandboxRuleMatch(path, runtimeConfig.filesystem.denyWrite, "denyWrite", cwd))
+    return null;
 
   const nextConfig = cloneRuntimeConfig(runtimeConfig);
   if (!mutateStringList(nextConfig.filesystem.allowWrite, "add", path)) return null;
@@ -114,25 +108,17 @@ function ensureTrailingNewline(text: string): string {
 }
 
 interface SandboxedBashOpsOptions {
-  getContext: () => ExtensionContext | null;
+  ctx: ExtensionContext;
   getSandboxConfig: () => SandboxConfig | null;
-  getRuntimeConfig: () => SandboxRuntimeConfig | null;
-  getPromptMode: () => PromptMode;
-  applyRuntimeConfigForSession: (
-    ctx: ExtensionContext,
-    runtimeConfig: SandboxRuntimeConfig,
-  ) => void;
+  getRuntimeConfig: () => SandboxPolicy | null;
+  applyRuntimeConfigForSession: (ctx: ExtensionContext, runtimeConfig: SandboxPolicy) => void;
   recordEvent?: (event: SandboxEvent) => void;
-}
-
-interface SandboxedBashOperations extends BashOperations {
-  runSerially<T>(task: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+  resolvePermission: (proposal: PermissionProposal) => Promise<PermissionResolution>;
 }
 
 interface BashAttemptResult {
   exitCode: number | null;
   combinedOutput: string;
-  interruptedByFilesystemViolation: boolean;
   runtimeProtectedWriteViolations: FilesystemViolation[];
 }
 
@@ -146,7 +132,8 @@ interface ProcessedSandboxAttempt {
 interface PreparedSandboxAttempt {
   attempt: BashAttemptResult;
   commandId: string;
-  runtimeConfig: SandboxRuntimeConfig | null;
+  runtimeConfig: SandboxPolicy | null;
+  policy: SandboxPolicy | null;
 }
 
 function killProcessGroup(
@@ -182,17 +169,14 @@ function safeCleanupAfterCommand(): void {
 }
 
 function maybeAllowGitMetadataWriteForSession(options: {
-  ctx: ExtensionContext | null;
+  ctx: ExtensionContext;
   cwd: string;
-  runtimeConfig: SandboxRuntimeConfig | null;
+  runtimeConfig: SandboxPolicy | null;
   allowGitCommonDir: boolean;
-  applyRuntimeConfigForSession: (
-    ctx: ExtensionContext,
-    runtimeConfig: SandboxRuntimeConfig,
-  ) => void;
+  applyRuntimeConfigForSession: (ctx: ExtensionContext, runtimeConfig: SandboxPolicy) => void;
 }): void {
   const { ctx, cwd, runtimeConfig, allowGitCommonDir, applyRuntimeConfigForSession } = options;
-  if (!ctx || !runtimeConfig) return;
+  if (!runtimeConfig) return;
   if (!isSandboxWritablePath(runtimeConfig, cwd, cwd)) return;
 
   const gitPaths = resolveGitFilesystemPaths(cwd);
@@ -209,104 +193,15 @@ function maybeAllowGitMetadataWriteForSession(options: {
   applyRuntimeConfigForSession(ctx, nextConfig);
 }
 
-/** Create a single-invocation native backend that requires fresh human approval. */
-export function createUnsandboxedBashOps(
-  runtime: SandboxRuntime,
-  sandboxedOps: SandboxedBashOperations,
-  ctx: ExtensionContext,
-  invocationSignal: AbortSignal,
-): BashOperations {
-  function assertAvailable(): void {
-    if (invocationSignal.aborted) throw new Error("aborted");
-    if (runtime.state.status !== "active") {
-      throw new Error("Unsandboxed request denied: the sandbox must be active.");
-    }
-    if (runtime.promptMode !== "interactive" || !ctx.hasUI || !["tui", "rpc"].includes(ctx.mode)) {
-      throw new Error("Unsandboxed request denied: interactive human approval is required.");
-    }
-    if (
-      ctx.mode === "rpc" &&
-      process.env.TAU_SUBAGENT_CHILD === "1" &&
-      process.env.TAU_SUBAGENT_UNSANDBOXED_APPROVAL !== "1"
-    ) {
-      throw new Error(
-        "Unsandboxed request denied: the parent does not advertise a safe approval broker. Reload the parent and start a new subagent before requesting approval.",
-      );
-    }
-  }
-
-  assertAvailable();
-  const local = createLocalBashOperations();
-  return {
-    exec(command, cwd, options) {
-      const absoluteCwd = resolve(cwd);
-      return sandboxedOps.runSerially(async () => {
-        assertAvailable();
-        if (options.signal?.aborted) throw new Error("aborted");
-        const title = formatUnsandboxedApproval(command);
-        let choice: string | undefined;
-        try {
-          choice = await ctx.ui.select(title, [...UNSANDBOXED_APPROVAL_CHOICES], {
-            signal: invocationSignal,
-          });
-        } catch (error) {
-          throw new Error("Unsandboxed request denied: human approval was unavailable.", {
-            cause: error,
-          });
-        }
-        assertAvailable();
-        if (options.signal?.aborted) throw new Error("aborted");
-        if (choice !== "Run once outside sandbox") {
-          throw new Error("Unsandboxed request denied: this invocation was not approved.");
-        }
-        return local.exec(command, absoluteCwd, options);
-      }, invocationSignal);
-    },
-  };
-}
-
-export function createSandboxedBashOps(options: SandboxedBashOpsOptions): SandboxedBashOperations {
+export function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperations {
   const {
-    getContext,
+    ctx,
     getSandboxConfig,
     getRuntimeConfig,
-    getPromptMode,
     applyRuntimeConfigForSession,
     recordEvent,
+    resolvePermission,
   } = options;
-  const pendingFilesystemDialogs = new Map<string, Promise<PermissionResolution | null>>();
-  const pendingMachLookupDialogs = new Map<string, Promise<PermissionResolution | null>>();
-
-  let executionQueue: Promise<void> = Promise.resolve();
-
-  function runSerially<T>(task: () => Promise<T>, signal?: AbortSignal): Promise<T> {
-    return new Promise<T>((resolve, reject) => {
-      let pending = true;
-      const cancel = () => {
-        if (!pending) return;
-        pending = false;
-        signal?.removeEventListener("abort", cancel);
-        reject(new Error("aborted"));
-      };
-      if (signal?.aborted) {
-        cancel();
-        return;
-      }
-      signal?.addEventListener("abort", cancel, { once: true });
-      const start = async () => {
-        if (!pending) return;
-        pending = false;
-        signal?.removeEventListener("abort", cancel);
-        try {
-          resolve(await task());
-        } catch (error) {
-          reject(error);
-        }
-      };
-      executionQueue = executionQueue.then(start, start);
-    });
-  }
-
   function withSandboxDefaultEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
     const baseEnv = env ?? process.env;
     if (baseEnv.GIT_OPTIONAL_LOCKS !== undefined) return baseEnv;
@@ -317,7 +212,7 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
     commandId: string,
     wrappedCommand: string,
     cwd: string,
-    runtimeConfig: SandboxRuntimeConfig | null,
+    runtimeConfig: SandboxPolicy | null,
     onData: (data: Buffer) => void,
     signal?: AbortSignal,
     timeout?: number,
@@ -333,53 +228,35 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
 
       const chunks: Buffer[] = [];
       let timedOut = false;
-      let interruptedByFilesystemViolation = false;
       let seenViolationCount = 0;
+      const violationStore = SandboxManager.getSandboxViolationStore();
       const runtimeProtectedWriteViolations = new Map<string, FilesystemViolation>();
       let timeoutHandle: NodeJS.Timeout | undefined;
       let timeoutEscalationHandle: NodeJS.Timeout | undefined;
-      let filesystemStopEscalationHandle: NodeJS.Timeout | undefined;
-
-      const stopForFilesystemViolation = (): void => {
-        if (interruptedByFilesystemViolation) return;
 
-        interruptedByFilesystemViolation = true;
-        killProcessGroup(child, "SIGTERM");
-        filesystemStopEscalationHandle = setTimeout(() => {
-          killProcessGroup(child, "SIGKILL");
-        }, 500);
-      };
-
-      // The Linux monitor filters attempts against configured write rules and does not
-      // report mandatory runtime denies within already-allowed paths, so runtime-protected
-      // continuation remains macOS-only.
+      // Retain protected-write observations beyond the runtime's bounded tail without
+      // interrupting recovery. The cumulative count keeps advancing when that tail fills.
       const unsubscribeViolations =
         process.platform !== "darwin"
           ? () => undefined
-          : SandboxManager.getSandboxViolationStore().subscribe(() => {
-              const violations =
-                SandboxManager.getSandboxViolationStore().getViolationsForCommand(commandId);
-              if (violations.length <= seenViolationCount) return;
-
-              const newViolations = violations.slice(seenViolationCount);
-              seenViolationCount = violations.length;
-
-              for (const violation of newViolations) {
+          : violationStore.subscribe(() => {
+              const total = violationStore.getTotalCount();
+              const added = total - seenViolationCount;
+              seenViolationCount = total;
+              if (added <= 0) return;
+
+              for (const violation of violationStore
+                .getViolationsForCommand(commandId)
+                .slice(-added)) {
                 const filesystemViolation = detectFilesystemViolationFromLine(violation.line);
-                if (filesystemViolation) {
-                  if (isTraversalViolation(runtimeConfig, filesystemViolation, cwd)) continue;
-
-                  if (isRuntimeProtectedWriteViolation(runtimeConfig, filesystemViolation, cwd)) {
-                    if (filesystemViolation.path) {
-                      runtimeProtectedWriteViolations.set(
-                        filesystemViolation.path,
-                        filesystemViolation,
-                      );
-                    }
-                    continue;
-                  }
-
-                  stopForFilesystemViolation();
+                if (
+                  filesystemViolation?.path &&
+                  isRuntimeProtectedWriteViolation(runtimeConfig, filesystemViolation, cwd)
+                ) {
+                  runtimeProtectedWriteViolations.set(
+                    filesystemViolation.path,
+                    filesystemViolation,
+                  );
                 }
               }
             });
@@ -410,7 +287,6 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
       child.on("error", (err) => {
         if (timeoutHandle) clearTimeout(timeoutHandle);
         if (timeoutEscalationHandle) clearTimeout(timeoutEscalationHandle);
-        if (filesystemStopEscalationHandle) clearTimeout(filesystemStopEscalationHandle);
         unsubscribeViolations();
         signal?.removeEventListener("abort", onAbort);
         killProcessGroup(child, "SIGKILL");
@@ -425,7 +301,6 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
       child.on("close", (code) => {
         if (timeoutHandle) clearTimeout(timeoutHandle);
         if (timeoutEscalationHandle) clearTimeout(timeoutEscalationHandle);
-        if (filesystemStopEscalationHandle) clearTimeout(filesystemStopEscalationHandle);
         unsubscribeViolations();
         signal?.removeEventListener("abort", onAbort);
 
@@ -440,9 +315,8 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
         }
 
         resolve({
-          exitCode: interruptedByFilesystemViolation && code === null ? 1 : code,
+          exitCode: code,
           combinedOutput: Buffer.concat(chunks).toString("utf-8"),
-          interruptedByFilesystemViolation,
           runtimeProtectedWriteViolations: Array.from(runtimeProtectedWriteViolations.values()),
         });
       });
@@ -467,9 +341,15 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
 
   function reportPostProcessingError(error: unknown): void {
     const message = `[sandbox] Post-processing error: ${error instanceof Error ? error.message : error}`;
-    const ctx = getContext();
-    if (ctx) notify(ctx, message, "warning");
-    else console.warn(message);
+    notify(ctx, message, "warning");
+  }
+
+  function recordStaleGrant(grant: TemporaryPermissionGrant): void {
+    try {
+      grant.onStalePolicy();
+    } catch {
+      // Diagnostic persistence must not replace the freshness error or skip cleanup.
+    }
   }
 
   async function prepareAndRunSandboxAttempt(options: {
@@ -479,29 +359,46 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
     signal?: AbortSignal;
     timeout?: number;
     env?: NodeJS.ProcessEnv;
+    retry?: Extract<PermissionResolution, { kind: "allow-retry" }>;
   }): Promise<PreparedSandboxAttempt> {
-    const { command, cwd, onData, signal, timeout, env } = options;
+    const { command, cwd, onData, signal, timeout, env, retry } = options;
+    const grant = retry?.grant;
 
-    maybeAllowGitMetadataWriteForSession({
-      ctx: getContext(),
-      cwd,
-      runtimeConfig: getRuntimeConfig(),
-      allowGitCommonDir: getSandboxConfig()?.filesystem.allowGitCommonDir === true,
-      applyRuntimeConfigForSession,
-    });
-
-    const runtimeConfig = getRuntimeConfig();
+    if (!grant) {
+      maybeAllowGitMetadataWriteForSession({
+        ctx,
+        cwd,
+        runtimeConfig: getRuntimeConfig(),
+        allowGitCommonDir: getSandboxConfig()?.filesystem.allowGitCommonDir === true,
+        applyRuntimeConfigForSession,
+      });
+    }
+    const policy = getRuntimeConfig();
+    if (grant && policy !== grant.policy) {
+      recordStaleGrant(grant);
+      throw new Error(
+        "Sandbox policy changed after classification; the temporary retry was cancelled.",
+      );
+    }
+    const runtimeConfig = grant?.config ?? policy;
     const attemptRuntimeConfig = runtimeConfig ? cloneRuntimeConfig(runtimeConfig) : null;
     const commandId = createSandboxCommandId();
 
+    const wrappedCommand = await SandboxManager.wrapWithSandbox(
+      command,
+      IS_MACOS ? MACOS_SANDBOX_SHELL : undefined,
+      attemptRuntimeConfig ?? undefined,
+      signal,
+      { commandId, commandText: command },
+    );
+
     try {
-      const wrappedCommand = await SandboxManager.wrapWithSandbox(
-        command,
-        IS_MACOS ? MACOS_SANDBOX_SHELL : undefined,
-        attemptRuntimeConfig ?? undefined,
-        signal,
-        { commandId, commandText: command },
-      );
+      if (signal?.aborted) throw new Error("aborted");
+      if (grant && getRuntimeConfig() !== grant.policy) {
+        recordStaleGrant(grant);
+        throw new Error("Sandbox policy changed while preparing the classifier-approved retry.");
+      }
+      if (retry) onData(Buffer.from(retry.message));
       const attempt = await runSandboxAttempt(
         commandId,
         wrappedCommand,
@@ -512,7 +409,7 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
         timeout,
         env,
       );
-      return { attempt, commandId, runtimeConfig: attemptRuntimeConfig };
+      return { attempt, commandId, runtimeConfig: attemptRuntimeConfig, policy };
     } catch (err) {
       safeCleanupAfterCommand();
       throw err;
@@ -524,10 +421,11 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
     command: string;
     commandId: string;
     cwd: string;
-    runtimeConfig: SandboxRuntimeConfig | null;
+    runtimeConfig: SandboxPolicy | null;
+    policy: SandboxPolicy | null;
     autoRetryAvailable: boolean;
   }): Promise<ProcessedSandboxAttempt> {
-    const { attempt, command, commandId, cwd, runtimeConfig, autoRetryAvailable } = options;
+    const { attempt, command, commandId, cwd, runtimeConfig, policy, autoRetryAvailable } = options;
     const annotatedOutput = SandboxManager.annotateStderrWithSandboxFailures(
       commandId,
       attempt.combinedOutput,
@@ -537,7 +435,7 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
       .getViolationsForCommand(commandId)
       .map((violation) => violation.line);
     const storedFilesystemViolations = storedViolationLines
-      .map((line) => detectFilesystemViolationFromLine(line))
+      .map(detectFilesystemViolationFromLine)
       .filter((violation): violation is FilesystemViolation => violation !== null);
     const runtimeProtectedWriteViolations = getRuntimeProtectedWriteViolations(
       runtimeConfig,
@@ -545,14 +443,20 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
       cwd,
     );
     const machLookupViolations = detectMachLookupViolations(storedViolationLines);
-    let postamble = extractAppendedSandboxAnnotation(attempt.combinedOutput, annotatedOutput);
+    const processed: ProcessedSandboxAttempt = {
+      exitCode: attempt.exitCode,
+      postamble: extractAppendedSandboxAnnotation(attempt.combinedOutput, annotatedOutput),
+      resolution: null,
+      runtimeProtectedWriteViolations,
+    };
 
     if (runtimeProtectedWriteViolations.length > 0) {
-      const notice = formatRuntimeProtectedWriteNotice(
-        runtimeProtectedWriteViolations,
-        !attempt.interruptedByFilesystemViolation,
+      const notice = formatRuntimeProtectedWriteNotice(runtimeProtectedWriteViolations);
+      processed.postamble = appendOutputPostamble(
+        processed.postamble,
+        notice,
+        attempt.combinedOutput,
       );
-      postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
 
       for (const violation of runtimeProtectedWriteViolations) {
         recordEvent?.({
@@ -568,14 +472,27 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
       }
     }
 
-    const commandSucceeded = attempt.exitCode === 0 && !attempt.interruptedByFilesystemViolation;
-    if (commandSucceeded) {
-      return {
-        exitCode: attempt.exitCode,
-        postamble,
-        resolution: null,
-        runtimeProtectedWriteViolations,
-      };
+    if (attempt.exitCode === 0) {
+      const paths = Array.from(
+        new Set(
+          storedFilesystemViolations
+            .filter(
+              (violation) =>
+                !isTraversalViolation(runtimeConfig, violation, cwd) &&
+                !isRuntimeProtectedWriteViolation(runtimeConfig, violation, cwd),
+            )
+            .flatMap((violation) => (violation.path ? [violation.path] : [])),
+        ),
+      );
+      if (paths.length > 0) {
+        const more = paths.length > 3 ? ` (+${paths.length - 3} more)` : "";
+        processed.postamble = appendOutputPostamble(
+          processed.postamble,
+          `[sandbox] Command exited 0 with filesystem diagnostics: ${paths.slice(0, 3).join(", ")}${more}`,
+          attempt.combinedOutput,
+        );
+      }
+      return processed;
     }
 
     if (
@@ -592,182 +509,140 @@ export function createSandboxedBashOps(options: SandboxedBashOpsOptions): Sandbo
         cwd,
         summary: "command reported a sandbox initialization failure",
       });
-      return {
-        exitCode: attempt.exitCode,
-        postamble: appendOutputPostamble(postamble, notice, attempt.combinedOutput),
-        resolution: null,
-        runtimeProtectedWriteViolations,
-      };
+      processed.postamble = appendOutputPostamble(
+        processed.postamble,
+        notice,
+        attempt.combinedOutput,
+      );
+      return processed;
     }
 
-    const traversalPaths = getTraversalPaths({
-      runtimeConfig,
-      output: annotatedOutput,
-      cwd,
-    });
+    const traversalPaths =
+      storedViolationLines.length === storedFilesystemViolations.length
+        ? getTraversalPaths({ runtimeConfig, violations: storedFilesystemViolations, cwd })
+        : null;
     const continuedTraversal = machLookupViolations.length === 0 ? traversalPaths : null;
-    const effectiveExitCode = continuedTraversal ? 0 : attempt.exitCode;
-    let resolution: PermissionResolution | null = null;
-
     if (continuedTraversal) {
-      const notice = formatTraversalNotice(continuedTraversal);
-      postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
-    } else {
-      const currentRuntimeConfig = getRuntimeConfig();
-      if (!currentRuntimeConfig) {
-        return {
-          exitCode: effectiveExitCode,
-          postamble,
-          resolution,
-          runtimeProtectedWriteViolations,
-        };
-      }
-
-      resolution = await handleFilesystemViolation({
-        ctx: getContext(),
-        promptMode: getPromptMode(),
-        runtimeConfig: currentRuntimeConfig,
-        getRuntimeConfig,
-        output: annotatedOutput,
-        rawOutput: attempt.combinedOutput,
-        command,
-        cwd,
-        pendingDialogs: pendingFilesystemDialogs,
-        applyRuntimeConfigForSession,
-        recordEvent,
-        autoRetryAvailable,
-        runtimeProtectedWriteViolations,
-        allowOutputFallback: machLookupViolations.length === 0,
-      });
-
-      if (!resolution) {
-        resolution = await handleMachLookupViolation({
-          ctx: getContext(),
-          promptMode: getPromptMode(),
-          runtimeConfig: currentRuntimeConfig,
-          violations: machLookupViolations,
-          command,
-          cwd,
-          pendingDialogs: pendingMachLookupDialogs,
-          applyRuntimeConfigForSession,
-          recordEvent,
-          autoRetryAvailable,
-        });
-      }
-
-      if (resolution) {
-        postamble = appendOutputPostamble(postamble, resolution.message, attempt.combinedOutput);
-      }
+      processed.exitCode = 0;
+      processed.postamble = appendOutputPostamble(
+        processed.postamble,
+        formatTraversalNotice(continuedTraversal),
+        attempt.combinedOutput,
+      );
+      return processed;
     }
 
-    return {
-      exitCode: effectiveExitCode,
-      postamble,
-      resolution,
-      runtimeProtectedWriteViolations,
+    const currentRuntimeConfig = getRuntimeConfig();
+    if (!currentRuntimeConfig) return processed;
+
+    const proposalOptions = {
+      runtimeConfig: currentRuntimeConfig,
+      command,
+      cwd,
+      rawOutput: attempt.combinedOutput,
+      autoRetryAvailable,
+      automaticReviewAvailable: policy === currentRuntimeConfig,
     };
+    const proposal =
+      proposeFilesystemPermission({
+        ...proposalOptions,
+        violations: storedFilesystemViolations.length
+          ? storedFilesystemViolations
+          : detectFilesystemViolations(attempt.combinedOutput, machLookupViolations.length === 0),
+        diagnosticSource: storedFilesystemViolations.length
+          ? IS_MACOS
+            ? "seatbelt-denial"
+            : "linux-write-attempt"
+          : "process-output",
+        runtimeProtectedWriteViolations,
+      }) ?? proposeMachLookupPermission({ ...proposalOptions, violations: machLookupViolations });
+    if (proposal) processed.resolution = await resolvePermission(proposal);
+    if (processed.resolution?.message && processed.resolution.kind !== "allow-retry") {
+      processed.postamble = appendOutputPostamble(
+        processed.postamble,
+        processed.resolution.message,
+        attempt.combinedOutput,
+      );
+    }
+    return processed;
   }
 
   return {
-    runSerially,
     async exec(command, cwd, { onData, signal, timeout, env }) {
       validateTimeout(timeout);
       if (!existsSync(cwd)) {
         throw new Error(`Working directory does not exist: ${cwd}`);
       }
 
-      const attemptStartedAt = Date.now();
-      const initialRun = await prepareAndRunSandboxAttempt({
-        command,
-        cwd,
-        onData,
-        signal,
-        timeout,
-        env,
-      });
-      const retryTimeout = getRemainingTimeout(timeout, attemptStartedAt);
-
-      let processedAttempt: ProcessedSandboxAttempt;
-      try {
-        processedAttempt = await processSandboxAttempt({
-          attempt: initialRun.attempt,
+      let attemptTimeout = timeout;
+      let retry: Extract<PermissionResolution, { kind: "allow-retry" }> | undefined;
+      for (;;) {
+        const attemptStartedAt = Date.now();
+        const run = await prepareAndRunSandboxAttempt({
           command,
-          commandId: initialRun.commandId,
           cwd,
-          runtimeConfig: initialRun.runtimeConfig,
-          autoRetryAvailable: true,
+          onData,
+          signal,
+          timeout: attemptTimeout,
+          env,
+          retry,
         });
-      } catch (postProcessError) {
-        reportPostProcessingError(postProcessError);
-        safeCleanupAfterCommand();
-        return { exitCode: initialRun.attempt.exitCode };
-      }
-
-      const retryResolution = processedAttempt.resolution;
-      if (retryResolution?.kind !== "allow-retry") {
-        if (processedAttempt.postamble) onData(Buffer.from(processedAttempt.postamble));
-        safeCleanupAfterCommand();
-        return { exitCode: processedAttempt.exitCode };
-      }
-
-      if (processedAttempt.postamble) {
-        onData(Buffer.from(ensureTrailingNewline(processedAttempt.postamble)));
-      }
-
-      initialRun.attempt.combinedOutput = "";
-      safeCleanupAfterCommand();
-
-      if (retryTimeout !== undefined && retryTimeout <= 0) {
-        onData(Buffer.from(retryResolution.retrySkippedMessage));
-        return { exitCode: processedAttempt.exitCode };
-      }
+        // Reserve the remaining execution allowance before classification or approval waits.
+        attemptTimeout = getRemainingTimeout(attemptTimeout, attemptStartedAt);
+        const autoRetryAvailable = !retry && (attemptTimeout === undefined || attemptTimeout > 0);
+        let processed: ProcessedSandboxAttempt;
+        try {
+          processed = await processSandboxAttempt({
+            ...run,
+            command,
+            cwd,
+            autoRetryAvailable,
+          });
+        } catch (postProcessError) {
+          reportPostProcessingError(postProcessError);
+          safeCleanupAfterCommand();
+          return { exitCode: run.attempt.exitCode };
+        }
 
-      const retryRun = await prepareAndRunSandboxAttempt({
-        command,
-        cwd,
-        onData,
-        signal,
-        timeout: retryTimeout,
-        env,
-      });
+        if (retry) {
+          let message = "";
+          if (processed.exitCode === 0) {
+            message = retry.grant
+              ? "\n[sandbox] Classifier-approved retry completed. The temporary exception was not saved.\n"
+              : `\n${retry.blockedTarget}\n\nAccess granted for this session and the command was retried successfully.`;
+          } else if (
+            !processed.resolution &&
+            processed.runtimeProtectedWriteViolations.length === 0
+          ) {
+            message = retry.grant
+              ? "\n[sandbox] Classifier-approved retry failed. No further automatic retry is allowed.\n"
+              : `\n${retry.blockedTarget}\n\nAccess granted for this session and the command was retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.`;
+          }
+          processed.postamble = appendOutputPostamble(
+            processed.postamble,
+            message,
+            run.attempt.combinedOutput,
+          );
+        }
 
-      let processedRetry: ProcessedSandboxAttempt;
-      try {
-        processedRetry = await processSandboxAttempt({
-          attempt: retryRun.attempt,
-          command,
-          commandId: retryRun.commandId,
-          cwd,
-          runtimeConfig: retryRun.runtimeConfig,
-          autoRetryAvailable: false,
-        });
-      } catch (postProcessError) {
-        reportPostProcessingError(postProcessError);
+        // A resolution from the retry can never schedule a third launch.
+        const nextRetry =
+          autoRetryAvailable && processed.resolution?.kind === "allow-retry"
+            ? processed.resolution
+            : undefined;
+        if (processed.postamble) {
+          onData(
+            Buffer.from(
+              nextRetry ? ensureTrailingNewline(processed.postamble) : processed.postamble,
+            ),
+          );
+        }
+        if (nextRetry) run.attempt.combinedOutput = "";
         safeCleanupAfterCommand();
-        return { exitCode: retryRun.attempt.exitCode };
-      }
+        if (!nextRetry) return { exitCode: processed.exitCode };
 
-      let retryPostamble = processedRetry.postamble;
-      if (processedRetry.exitCode === 0) {
-        retryPostamble = appendOutputPostamble(
-          retryPostamble,
-          retryResolution.retrySuccessMessage,
-          retryRun.attempt.combinedOutput,
-        );
-      } else if (
-        !processedRetry.resolution &&
-        processedRetry.runtimeProtectedWriteViolations.length === 0
-      ) {
-        retryPostamble = appendOutputPostamble(
-          retryPostamble,
-          retryResolution.retryFailureMessage,
-          retryRun.attempt.combinedOutput,
-        );
+        retry = nextRetry;
       }
-
-      if (retryPostamble) onData(Buffer.from(retryPostamble));
-      safeCleanupAfterCommand();
-      return { exitCode: processedRetry.exitCode };
     },
   };
 }