tau-coding-agent 0.1.3 → 0.1.5

package/extensions/sandbox/index.ts

@@ -25,8 +25,9 @@
  *   },
  *   "filesystem": {
  *     "denyRead": ["~/.ssh", "~/.aws"],
- *     "allowWrite": [".", "/tmp"],
+ *     "allowWrite": ["."],
  *     "denyWrite": [".env"],
+ *     "allowTempDirs": true,
  *     "allowGitCommonDir": true
  *   }
  * }
@@ -47,7 +48,7 @@
 
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import {
   SandboxManager,
@@ -62,12 +63,20 @@ import {
   globToRegex,
   normalizePathForSandbox,
 } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
-import type { ExtensionAPI, ExtensionContext } from "@mariozechner/pi-coding-agent";
-import { type BashOperations, createBashTool } from "@mariozechner/pi-coding-agent";
+import {
+  CONFIG_DIR_NAME,
+  createBashTool,
+  getAgentDir,
+  type BashOperations,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 
 // --- Constants ---
 
 const DEFAULT_PROMPT_MODE: PromptMode = "interactive";
+const MAX_TIMEOUT_MS = 2_147_483_647;
+const MAX_TIMEOUT_SECONDS = MAX_TIMEOUT_MS / 1000;
 
 const DEFAULT_CONFIG: SandboxConfig = {
   enabled: true,
@@ -78,30 +87,43 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "127.0.0.1",
       "npmjs.org",
       "*.npmjs.org",
-      "registry.npmjs.org",
+      "npmjs.com",
+      "*.npmjs.com",
       "registry.yarnpkg.com",
+      "nodejs.org",
+      "*.nodejs.org",
       "pypi.org",
       "*.pypi.org",
       "pythonhosted.org",
       "*.pythonhosted.org",
       "crates.io",
       "*.crates.io",
+      "rustup.rs",
+      "*.rust-lang.org",
+      "repo.maven.apache.org",
+      "gradle.org",
+      "*.gradle.org",
       "proxy.golang.org",
       "sum.golang.org",
       "go.dev",
       "golang.org",
       "rubygems.org",
       "*.rubygems.org",
+      "nuget.org",
+      "*.nuget.org",
       "github.com",
       "*.github.com",
       "githubusercontent.com",
       "*.githubusercontent.com",
-      "api.github.com",
-      "raw.githubusercontent.com",
+      "gitlab.com",
+      "*.gitlab.com",
+      "bitbucket.org",
+      "*.bitbucket.org",
       "ghcr.io",
       "docker.io",
       "*.docker.io",
-      "production.cloudflare.docker.com",
+      "docker.com",
+      "*.docker.com",
       "sentry.io",
       "*.sentry.io",
       "datadoghq.com",
@@ -116,6 +138,8 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "*.openai.com",
       "chatgpt.com",
       "*.chatgpt.com",
+      "openrouter.ai",
+      "*.openrouter.ai",
       "google.com",
       "*.google.com",
       "googleapis.com",
@@ -128,21 +152,64 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "*.doist.com",
     ],
     deniedDomains: [],
+    allowUnixSockets: ["$SSH_AUTH_SOCK"],
     allowLocalBinding: true,
   },
   filesystem: {
     denyRead: ["~/.ssh", "~/.aws", "~/.gnupg"],
-    allowWrite: [".", "/tmp", "/private/tmp", "~/.cache", "~/.npm"],
-    denyWrite: [".env", ".env.*", "*.pem", "*.key"],
+    allowRead: ["~/.ssh/config", "~/.ssh/known_hosts", "~/.ssh/*.pub"],
+    allowWrite: [
+      ".",
+      "~/.cache",
+      "~/Library/Caches",
+      join(getAgentDir(), "*.lock"),
+      "~/**/__pycache__",
+      "~/**/__pycache__/*",
+      "~/.npm",
+      "~/.rustup",
+      "~/.cargo/registry",
+      "~/.cargo/git",
+      "~/.cargo/.package-cache",
+      "~/.cargo/.package-cache-mutate",
+      "~/.cargo/.global-cache",
+      "~/go/pkg",
+      "~/.m2/repository",
+      "~/.m2/wrapper/dists",
+      "~/.gradle",
+      "~/Library/Application Support/kotlin",
+      "~/.android",
+      "~/.bundle/cache",
+      "~/.gem/cache",
+      "~/.gem/specs",
+      "~/.nuget/packages",
+      "~/.local/share/NuGet/*-cache",
+      "~/.local/share/NuGet/*-cache/**",
+    ],
+    denyWrite: [
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      "~/.gradle/gradle.properties",
+      "~/.gradle/init.gradle",
+      "~/.gradle/init.gradle.kts",
+      "~/.gradle/init.d",
+      "~/.android/adbkey",
+    ],
+    allowTempDirs: true,
     allowGitConfig: true,
     allowGitCommonDir: true,
   },
+  ignoreViolations: {
+    "*": ["/__pycache__"],
+  },
 };
 
 const STATUS_KEY = "sandbox";
 const SANDBOX_EVENT_LIMIT = 50;
-const METADATA_TRAVERSAL_PROCESSES = new Set(["find", "ls", "fd", "fdfind"]);
+const READ_TRAVERSAL_PROCESSES = new Set(["find", "ls", "fd", "fdfind"]);
 const GIT_FILESYSTEM_PATHS_CACHE = new Map<string, GitFilesystemPaths | null>();
+const ENV_PATH_REFERENCE_PATTERN = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;
 
 // --- Types ---
 
@@ -156,7 +223,7 @@ type SandboxRunMode = "sandbox" | "user-disabled" | SandboxBypassReason | Sandbo
 type SandboxState =
   | { status: "pending" }
   | { status: "active"; runtimeConfig: SandboxRuntimeConfig }
-  | { status: "suspended"; runtimeConfig: SandboxRuntimeConfig }
+  | { status: "suspended" }
   | { status: "bypassed"; reason: SandboxBypassReason }
   | { status: "blocked"; reason: SandboxBlockedReason };
 
@@ -164,6 +231,7 @@ type SandboxConfig = Omit<SandboxRuntimeConfig, "filesystem"> & {
   enabled?: boolean;
   mode?: PromptMode;
   filesystem: SandboxRuntimeConfig["filesystem"] & {
+    allowTempDirs?: boolean;
     allowGitCommonDir?: boolean;
   };
 };
@@ -181,7 +249,7 @@ type SandboxEventReason =
   | "already-approved-still-failed"
   | "unknown";
 type SandboxEventOutcome = "blocked" | "allowed";
-type SandboxConfigPathStatus = "loaded" | "parse-error";
+type SandboxConfigPathStatus = "loaded" | "parse-error" | "skipped-untrusted";
 type SandboxConfigPathLabel = "Global" | "Project" | "Override";
 
 type PromptStatus = "completed" | "error";
@@ -193,6 +261,7 @@ type FilesystemList = "deny-read" | "allow-write" | "deny-write";
 
 type FilesystemViolationKind = "read" | "write" | "unknown";
 type FilesystemReadAccess = "metadata" | "data" | "unknown";
+type FilesystemWriteAccess = "unlink" | "unknown";
 type FilesystemViolationResolutionKind = "allow-retry" | "allow-adapt" | "deny";
 
 interface SandboxEvent {
@@ -242,6 +311,7 @@ interface FilesystemViolation {
   path?: string;
   processName?: string;
   readAccess?: FilesystemReadAccess;
+  writeAccess?: FilesystemWriteAccess;
 }
 
 type FilesystemViolationResolution =
@@ -572,12 +642,7 @@ function formatSandboxConfigLoadErrorMessage(
   return `Could not read sandbox override config ${path}: ${detail ?? "unknown error"}`;
 }
 
-function coerceStringArray(value: unknown, fallback: string[], field: string): string[] {
-  if (!Array.isArray(value)) {
-    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
-    return [...fallback];
-  }
-
+function cleanStringArray(value: unknown[], field: string): string[] {
   const cleaned = value
     .filter((item): item is string => typeof item === "string")
     .map((item) => item.trim())
@@ -591,6 +656,30 @@ function coerceStringArray(value: unknown, fallback: string[], field: string): s
   return cleaned;
 }
 
+function coerceStringArray(value: unknown, fallback: string[], field: string): string[] {
+  if (!Array.isArray(value)) {
+    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
+    return [...fallback];
+  }
+
+  return cleanStringArray(value, field);
+}
+
+function coerceOptionalStringArray(
+  value: unknown,
+  fallback: string[] | undefined,
+  field: string,
+): string[] | undefined {
+  if (value === undefined) return fallback ? [...fallback] : undefined;
+
+  if (!Array.isArray(value)) {
+    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
+    return fallback ? [...fallback] : undefined;
+  }
+
+  return cleanStringArray(value, field);
+}
+
 function finalizeConfig(config: SandboxConfig): SandboxConfig {
   return {
     ...config,
@@ -608,6 +697,11 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.network.deniedDomains,
         "network.deniedDomains",
       ),
+      allowUnixSockets: coerceOptionalStringArray(
+        config.network?.allowUnixSockets,
+        DEFAULT_CONFIG.network.allowUnixSockets,
+        "network.allowUnixSockets",
+      ),
     },
     filesystem: {
       ...config.filesystem,
@@ -616,6 +710,11 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.filesystem.denyRead,
         "filesystem.denyRead",
       ),
+      allowRead: coerceOptionalStringArray(
+        config.filesystem?.allowRead,
+        DEFAULT_CONFIG.filesystem.allowRead,
+        "filesystem.allowRead",
+      ),
       allowWrite: coerceStringArray(
         config.filesystem?.allowWrite,
         DEFAULT_CONFIG.filesystem.allowWrite,
@@ -626,6 +725,10 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.filesystem.denyWrite,
         "filesystem.denyWrite",
       ),
+      allowTempDirs:
+        typeof config.filesystem?.allowTempDirs === "boolean"
+          ? config.filesystem.allowTempDirs
+          : DEFAULT_CONFIG.filesystem.allowTempDirs,
       allowGitCommonDir:
         typeof config.filesystem?.allowGitCommonDir === "boolean"
           ? config.filesystem.allowGitCommonDir
@@ -673,13 +776,17 @@ function loadOverrideConfig(cwd: string, overrideConfigPath: string): LoadedSand
   };
 }
 
-function loadConfig(cwd: string, overrideConfigPath?: string): LoadedSandboxConfig {
+function loadConfig(
+  cwd: string,
+  overrideConfigPath?: string,
+  options: { projectTrusted?: boolean } = {},
+): LoadedSandboxConfig {
   if (overrideConfigPath) {
     return loadOverrideConfig(cwd, overrideConfigPath);
   }
 
-  const projectConfigPath = join(cwd, ".pi", "sandbox.json");
-  const globalConfigPath = join(homedir(), ".pi", "agent", "sandbox.json");
+  const projectConfigPath = join(cwd, CONFIG_DIR_NAME, "sandbox.json");
+  const globalConfigPath = join(getAgentDir(), "sandbox.json");
 
   let globalConfig: Partial<SandboxConfig> = {};
   let projectConfig: Partial<SandboxConfig> = {};
@@ -696,12 +803,16 @@ function loadConfig(cwd: string, overrideConfigPath?: string): LoadedSandboxConf
   }
 
   if (existsSync(projectConfigPath)) {
-    try {
-      projectConfig = JSON.parse(readFileSync(projectConfigPath, "utf-8"));
-      paths.push({ label: "Project", path: projectConfigPath, status: "loaded" });
-    } catch (e) {
-      paths.push({ label: "Project", path: projectConfigPath, status: "parse-error" });
-      console.error(`Warning: Could not parse ${projectConfigPath}: ${e}`);
+    if (options.projectTrusted !== true) {
+      paths.push({ label: "Project", path: projectConfigPath, status: "skipped-untrusted" });
+    } else {
+      try {
+        projectConfig = JSON.parse(readFileSync(projectConfigPath, "utf-8"));
+        paths.push({ label: "Project", path: projectConfigPath, status: "loaded" });
+      } catch (e) {
+        paths.push({ label: "Project", path: projectConfigPath, status: "parse-error" });
+        console.error(`Warning: Could not parse ${projectConfigPath}: ${e}`);
+      }
     }
   }
 
@@ -749,12 +860,145 @@ function deepMerge(base: SandboxConfig, overrides: Partial<SandboxConfig>): Sand
   return result;
 }
 
+let cachedTemporaryWritePaths: string[] | undefined;
+
+function getTemporaryWritePaths(): string[] {
+  if (cachedTemporaryWritePaths) return cachedTemporaryWritePaths;
+
+  // allowTempDirs always includes the conventional shared temp path, even when
+  // os.tmpdir() points at a platform-specific per-user directory.
+  const currentTmpDir = tmpdir();
+  const paths = ["/tmp", currentTmpDir, normalizePathForSandbox(currentTmpDir)];
+  if (process.platform === "darwin") paths.push("/private/tmp");
+
+  cachedTemporaryWritePaths = Array.from(
+    new Set(paths.map((path) => path.replace(/\/+$/, "") || "/")),
+  );
+  return cachedTemporaryWritePaths;
+}
+
+function deduplicateStrings(values: string[]): string[] {
+  return Array.from(new Set(values));
+}
+
+function deduplicateOptionalStrings(values: string[] | undefined): string[] | undefined {
+  return values ? deduplicateStrings(values) : undefined;
+}
+
+function containsControlCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function expandPathConfigEntry(value: string, field: string): string | null {
+  const source = value.trim();
+  if (!source) return null;
+
+  const missingEnvNames = new Set<string>();
+  const expanded = source.replace(
+    ENV_PATH_REFERENCE_PATTERN,
+    (_match, bracedName: string | undefined, bareName: string | undefined) => {
+      const envName = bracedName ?? bareName;
+      const envValue = envName ? (process.env[envName]?.trim() ?? "") : "";
+      if (!envValue) {
+        if (envName) missingEnvNames.add(envName);
+        return "";
+      }
+      return envValue;
+    },
+  );
+
+  if (missingEnvNames.size > 0) {
+    const names = Array.from(missingEnvNames).join(", ");
+    const label = missingEnvNames.size === 1 ? "environment variable" : "environment variables";
+    const verb = missingEnvNames.size === 1 ? "is" : "are";
+    console.error(
+      `Warning: Ignoring ${field} entry because ${label} ${names} ${verb} unset or empty.`,
+    );
+    return null;
+  }
+
+  if (containsControlCharacter(expanded)) {
+    console.error(
+      `Warning: Ignoring ${field} entry because the expanded path contains control characters.`,
+    );
+    return null;
+  }
+
+  return expanded;
+}
+
+function expandPathConfigList(values: string[] | undefined, field: string): string[] | undefined {
+  if (!values) return undefined;
+
+  return values
+    .map((value) => expandPathConfigEntry(value, field))
+    .filter((value): value is string => value !== null);
+}
+
+function expandMitmProxyPathConfig(
+  mitmProxy: SandboxRuntimeConfig["network"]["mitmProxy"],
+): SandboxRuntimeConfig["network"]["mitmProxy"] {
+  if (!mitmProxy) return undefined;
+  if (!isPlainObject(mitmProxy) || typeof mitmProxy.socketPath !== "string") return mitmProxy;
+
+  const socketPath = expandPathConfigEntry(mitmProxy.socketPath, "network.mitmProxy.socketPath");
+  if (!socketPath) {
+    console.error("Warning: Disabling network.mitmProxy because its socketPath did not expand.");
+    return undefined;
+  }
+
+  return { ...mitmProxy, socketPath } as SandboxRuntimeConfig["network"]["mitmProxy"];
+}
+
+function expandNetworkPathConfig(
+  network: SandboxRuntimeConfig["network"],
+): SandboxRuntimeConfig["network"] {
+  return {
+    ...network,
+    allowUnixSockets: expandPathConfigList(network.allowUnixSockets, "network.allowUnixSockets"),
+    mitmProxy: expandMitmProxyPathConfig(network.mitmProxy),
+  };
+}
+
+function expandFilesystemPathConfig(
+  filesystem: SandboxRuntimeConfig["filesystem"],
+): SandboxRuntimeConfig["filesystem"] {
+  return {
+    ...filesystem,
+    denyRead: expandPathConfigList(filesystem.denyRead, "filesystem.denyRead") ?? [],
+    allowRead: expandPathConfigList(filesystem.allowRead, "filesystem.allowRead"),
+    allowWrite: expandPathConfigList(filesystem.allowWrite, "filesystem.allowWrite") ?? [],
+    denyWrite: expandPathConfigList(filesystem.denyWrite, "filesystem.denyWrite") ?? [],
+  };
+}
+
 function toRuntimeConfig(config: SandboxConfig): SandboxRuntimeConfig {
-  const { allowGitCommonDir: _allowGitCommonDir, ...filesystem } = config.filesystem;
+  const { allowGitCommonDir: _allowGitCommonDir, allowTempDirs, ...filesystem } = config.filesystem;
+  const expandedNetwork = expandNetworkPathConfig(config.network);
+  const expandedFilesystem = expandFilesystemPathConfig(filesystem);
+  const allowWrite = allowTempDirs
+    ? [...expandedFilesystem.allowWrite, ...getTemporaryWritePaths()]
+    : expandedFilesystem.allowWrite;
 
   return {
-    network: config.network,
-    filesystem,
+    network: {
+      ...expandedNetwork,
+      allowUnixSockets: deduplicateOptionalStrings(expandedNetwork.allowUnixSockets),
+    },
+    filesystem: {
+      ...expandedFilesystem,
+      denyRead: deduplicateStrings(expandedFilesystem.denyRead),
+      allowRead: deduplicateOptionalStrings(expandedFilesystem.allowRead),
+      allowWrite: deduplicateStrings(allowWrite),
+      denyWrite: deduplicateStrings(expandedFilesystem.denyWrite),
+    },
     ignoreViolations: config.ignoreViolations,
     enableWeakerNestedSandbox: config.enableWeakerNestedSandbox,
     enableWeakerNetworkIsolation: config.enableWeakerNetworkIsolation,
@@ -791,6 +1035,19 @@ function inferSandboxRuleMatch(path: string, rules: string[], cwd?: string): str
   return null;
 }
 
+function matchesSandboxRuleExactly(path: string, rule: string, cwd?: string): boolean {
+  if (containsGlobChars(rule)) return false;
+  return normalizeSandboxPath(path) === normalizeSandboxPath(rule, cwd);
+}
+
+function inferExactSandboxRuleMatch(path: string, rules: string[], cwd?: string): string | null {
+  for (const rule of rules) {
+    if (matchesSandboxRuleExactly(path, rule, cwd)) return rule;
+  }
+
+  return null;
+}
+
 function isSandboxWritablePath(
   runtimeConfig: SandboxRuntimeConfig,
   path: string,
@@ -930,7 +1187,9 @@ function extractPathLikeValue(text: string): string | undefined {
 
 function extractViolationProcessName(line: string): string | undefined {
   const match = line.match(/^([^\s(]+)\(/);
-  return match?.[1]?.trim() || undefined;
+  const processName = match?.[1]?.trim();
+  if (!processName) return undefined;
+  return processName.split("/").pop() || processName;
 }
 
 function detectFilesystemViolationFromLine(line: string): FilesystemViolation | null {
@@ -939,8 +1198,12 @@ function detectFilesystemViolationFromLine(line: string): FilesystemViolation |
   const path = extractPathLikeValue(line);
   const processName = extractViolationProcessName(line);
 
+  if (lower.includes("file-write-unlink")) {
+    return { kind: "write", path, processName, writeAccess: "unlink" };
+  }
+
   if (lower.includes("file-write")) {
-    return { kind: "write", path, processName };
+    return { kind: "write", path, processName, writeAccess: "unknown" };
   }
 
   if (lower.includes("file-read-metadata")) {
@@ -989,19 +1252,30 @@ function detectFilesystemViolations(
   return violations;
 }
 
-function isMetadataTraversalViolation(
+function isTraversalViolation(
   runtimeConfig: SandboxRuntimeConfig | null,
   violation: FilesystemViolation,
   cwd?: string,
 ): boolean {
-  if (!runtimeConfig || violation.kind !== "read" || violation.readAccess !== "metadata")
-    return false;
-  if (!violation.path || !METADATA_TRAVERSAL_PROCESSES.has(violation.processName ?? ""))
-    return false;
-  return inferSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null;
+  if (!runtimeConfig || !violation.path) return false;
+  if (!READ_TRAVERSAL_PROCESSES.has(violation.processName ?? "")) return false;
+
+  if (violation.kind === "read") {
+    return inferSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null;
+  }
+
+  if (violation.kind !== "write" || violation.writeAccess !== "unlink") return false;
+
+  // Seatbelt can emit file-write-unlink checks for protected directory roots
+  // while traversal commands enumerate them. Only exact protected roots are
+  // treated as skipped traversal so writes under protected trees still prompt.
+  return (
+    inferExactSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null ||
+    inferExactSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyWrite, cwd) !== null
+  );
 }
 
-function getMetadataTraversalPaths(options: {
+function getTraversalPaths(options: {
   runtimeConfig: SandboxRuntimeConfig | null;
   output: string;
   cwd?: string;
@@ -1020,7 +1294,7 @@ function getMetadataTraversalPaths(options: {
   const skippedPaths: string[] = [];
   for (const line of violationLines) {
     const violation = detectFilesystemViolationFromLine(line);
-    if (!violation || !isMetadataTraversalViolation(runtimeConfig, violation, cwd)) {
+    if (!violation || !isTraversalViolation(runtimeConfig, violation, cwd)) {
       return null;
     }
     if (violation.path && !skippedPaths.includes(violation.path)) {
@@ -1031,7 +1305,7 @@ function getMetadataTraversalPaths(options: {
   return skippedPaths.length > 0 ? skippedPaths : null;
 }
 
-function formatMetadataTraversalNotice(paths: string[]): string {
+function formatTraversalNotice(paths: string[]): string {
   if (paths.length === 0) return "";
 
   const visiblePaths = paths.slice(0, 3).join(", ");
@@ -1184,32 +1458,36 @@ function parseFilesystemPromptSelection(
   return "deny";
 }
 
-function formatFilesystemAllowRetryMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nGranting access and retrying the command per user request...\n\n";
+function formatFilesystemAllowRetryMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nGranting access and retrying the command per user request...\n\n`;
 }
 
-function formatFilesystemAllowAdaptMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nAccess granted for this session. Retry the command manually if appropriate.";
+function formatFilesystemAllowAdaptMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session. Retry the command manually if appropriate.`;
 }
 
-function formatFilesystemDeniedMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nAccess remains denied for this session.";
+function formatFilesystemDeniedMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess remains denied for this session.`;
 }
 
-function formatFilesystemAlreadyAllowedMessage(_target: string): string {
-  return "\nSandbox blocked access again after permission had already been granted. The remaining failure may be unrelated to sandbox policy.";
+function formatFilesystemAlreadyAllowedMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess had already been granted for this session. The remaining failure may be unrelated to sandbox policy.`;
 }
 
 function formatFilesystemRetrySucceededMessage(_target: string): string {
   return "";
 }
 
-function formatFilesystemRetryFailedMessage(_target: string): string {
-  return "\nAccess granted and command retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.";
+function formatFilesystemRetryFailedMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session and the command was retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.`;
+}
+
+function formatFilesystemRetrySkippedMessage(target: string): string {
+  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.`;
 }
 
-function formatFilesystemRetrySkippedMessage(_target: string): string {
-  return "\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.";
+function formatFilesystemBlockedTarget(target: string): string {
+  return `Sandbox blocked filesystem ${target}.`;
 }
 
 function appendOutputPostamble(postamble: string, addition: string, output: string): string {
@@ -1475,6 +1753,12 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     return run;
   }
 
+  function withSandboxDefaultEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+    const baseEnv = env ?? process.env;
+    if (baseEnv.GIT_OPTIONAL_LOCKS !== undefined) return baseEnv;
+    return { ...baseEnv, GIT_OPTIONAL_LOCKS: "0" };
+  }
+
   async function runSandboxAttempt(
     command: string,
     wrappedCommand: string,
@@ -1488,7 +1772,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     return new Promise((resolve, reject) => {
       const child = spawn("bash", ["-c", wrappedCommand], {
         cwd,
-        env,
+        env: withSandboxDefaultEnv(env),
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
       });
@@ -1531,7 +1815,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
               const shouldStop = newViolations.some((violation) => {
                 const filesystemViolation = detectFilesystemViolationFromLine(violation.line);
                 if (!filesystemViolation) return false;
-                return !isMetadataTraversalViolation(runtimeConfig, filesystemViolation, cwd);
+                return !isTraversalViolation(runtimeConfig, filesystemViolation, cwd);
               });
               if (shouldStop) {
                 stopForFilesystemViolation();
@@ -1602,6 +1886,16 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     });
   }
 
+  function validateTimeout(timeout: number | undefined): void {
+    if (timeout === undefined) return;
+    if (!Number.isFinite(timeout) || timeout <= 0) {
+      throw new Error("Invalid timeout: must be a finite number of seconds");
+    }
+    if (timeout * 1000 > MAX_TIMEOUT_MS) {
+      throw new Error(`Invalid timeout: maximum is ${MAX_TIMEOUT_SECONDS} seconds`);
+    }
+  }
+
   function getRemainingTimeout(timeout: number | undefined, startedAt: number): number | undefined {
     if (timeout === undefined) return undefined;
 
@@ -1674,13 +1968,13 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
       attempt.combinedOutput,
     );
     const runtimeConfig = getRuntimeConfig();
-    const metadataTraversalPaths = getMetadataTraversalPaths({
+    const traversalPaths = getTraversalPaths({
       runtimeConfig,
       output: annotatedOutput,
       cwd,
       skipViolationLines: existingViolationCount,
     });
-    const effectiveExitCode = metadataTraversalPaths ? 0 : attempt.exitCode;
+    const effectiveExitCode = traversalPaths ? 0 : attempt.exitCode;
     let postamble = extractAppendedSandboxAnnotation(
       attempt.combinedOutput,
       annotatedOutput,
@@ -1688,8 +1982,8 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     );
     let resolution: FilesystemViolationResolution | null = null;
 
-    if (metadataTraversalPaths) {
-      const notice = formatMetadataTraversalNotice(metadataTraversalPaths);
+    if (traversalPaths) {
+      const notice = formatTraversalNotice(traversalPaths);
       postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
     } else if (runtimeConfig) {
       resolution = await handleFilesystemViolation({
@@ -1718,6 +2012,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
 
   return {
     async exec(command, cwd, { onData, signal, timeout, env }) {
+      validateTimeout(timeout);
       return runSerially(async () => {
         if (!existsSync(cwd)) {
           throw new Error(`Working directory does not exist: ${cwd}`);
@@ -1822,7 +2117,7 @@ function getSandboxRunMode(state: SandboxState): SandboxRunMode {
 }
 
 function getStateRuntimeConfig(state: SandboxState): SandboxRuntimeConfig | null {
-  if (state.status === "active" || state.status === "suspended") return state.runtimeConfig;
+  if (state.status === "active") return state.runtimeConfig;
   return null;
 }
 
@@ -1958,7 +2253,12 @@ function renderSandboxDoctorReport(options: {
   } else {
     lines.push("- Config paths:");
     for (const configPath of configPaths) {
-      const status = configPath.status === "loaded" ? "loaded" : "parse error";
+      const status =
+        configPath.status === "loaded"
+          ? "loaded"
+          : configPath.status === "skipped-untrusted"
+            ? "skipped (project not trusted)"
+            : "parse error";
       lines.push(`  - ${configPath.label}: ${configPath.path} (${status})`);
     }
   }
@@ -1990,6 +2290,10 @@ function getSandboxConfigParseErrors(paths: SandboxConfigPath[]): SandboxConfigP
   return paths.filter((configPath) => configPath.status === "parse-error");
 }
 
+function getSkippedUntrustedProjectConfigPaths(paths: SandboxConfigPath[]): SandboxConfigPath[] {
+  return paths.filter((configPath) => configPath.status === "skipped-untrusted");
+}
+
 function notifySandboxConfigParseErrors(ctx: ExtensionContext, paths: SandboxConfigPath[]): void {
   const details = paths
     .map((configPath) => `${configPath.label.toLowerCase()} (${configPath.path})`)
@@ -2015,7 +2319,7 @@ function loadSandboxConfigForContext(
   const { exitOnError = false } = options;
 
   try {
-    return loadConfig(cwd, overrideConfigPath);
+    return loadConfig(cwd, overrideConfigPath, { projectTrusted: ctx.isProjectTrusted() });
   } catch (error) {
     if (!(error instanceof SandboxConfigLoadError)) throw error;
 
@@ -2056,6 +2360,7 @@ export default function (pi: ExtensionAPI) {
   let sessionContext: ExtensionContext | null = null;
   let sandboxConfigPaths: SandboxConfigPath[] = [];
   let sandboxEvents: SandboxEvent[] = [];
+  const warnedSkippedProjectConfigPaths = new Set<string>();
 
   const pendingNetworkApprovals = new Map<string, Promise<boolean>>();
 
@@ -2100,21 +2405,38 @@ export default function (pi: ExtensionAPI) {
     });
   }
 
+  function notifySkippedUntrustedProjectConfigs(ctx: ExtensionContext): void {
+    const skippedConfigs = getSkippedUntrustedProjectConfigPaths(sandboxConfigPaths).filter(
+      (configPath) => !warnedSkippedProjectConfigPaths.has(configPath.path),
+    );
+    if (skippedConfigs.length === 0) return;
+
+    for (const configPath of skippedConfigs) {
+      warnedSkippedProjectConfigPaths.add(configPath.path);
+    }
+
+    const details = skippedConfigs.map((configPath) => configPath.path).join(", ");
+    notify(
+      ctx,
+      `Ignoring project sandbox config because this project is not trusted: ${details}`,
+      "warning",
+    );
+  }
+
   function applyRuntimeConfigForSession(
     ctx: ExtensionContext,
     runtimeConfig: SandboxRuntimeConfig,
-    targetStatus: "active" | "suspended" = sandboxState.status === "suspended"
-      ? "suspended"
-      : "active",
   ): void {
     const nextConfig = cloneRuntimeConfig(runtimeConfig);
-    sandboxState = { status: targetStatus, runtimeConfig: nextConfig };
+    sandboxState = { status: "active", runtimeConfig: nextConfig };
     SandboxManager.updateConfig(nextConfig);
-    setSandboxStatus(ctx, targetStatus === "active", nextConfig, promptMode);
+    setSandboxStatus(ctx, true, nextConfig, promptMode);
   }
 
   const createNetworkAskCallback = (): SandboxAskCallback => {
     return async ({ host, port }) => {
+      if (sandboxState.status === "suspended") return true;
+
       const normalizedHost = host.toLowerCase();
       const key = normalizedHost;
 
@@ -2328,6 +2650,7 @@ export default function (pi: ExtensionAPI) {
     if (!loadedConfig) return;
 
     sandboxConfigPaths = loadedConfig.paths;
+    notifySkippedUntrustedProjectConfigs(ctx);
     const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
     if (parseErrors.length > 0) {
       notifySandboxConfigParseErrors(ctx, parseErrors);
@@ -2417,45 +2740,32 @@ export default function (pi: ExtensionAPI) {
           return;
         }
 
-        let runtimeConfig: SandboxRuntimeConfig | null = null;
-        let initializedNow = false;
-
-        if (sandboxState.status === "suspended") {
-          runtimeConfig = sandboxState.runtimeConfig;
-        } else {
-          if (!isSupportedPlatform()) {
-            sandboxState = { status: "blocked", reason: "unsupported-platform" };
-            recordRuntimeEvent(
-              "init",
-              "unsupported-platform",
-              `sandbox not supported on ${process.platform}`,
-            );
-            notify(ctx, `Sandbox not supported on ${process.platform}`, "warning");
-            return;
-          }
+        if (!isSupportedPlatform()) {
+          sandboxState = { status: "blocked", reason: "unsupported-platform" };
+          recordRuntimeEvent(
+            "init",
+            "unsupported-platform",
+            `sandbox not supported on ${process.platform}`,
+          );
+          notify(ctx, `Sandbox not supported on ${process.platform}`, "warning");
+          return;
+        }
 
-          const sandboxConfigOverride = getStringFlag(pi, "sandbox-config");
-          const loadedConfig = loadSandboxConfigForContext(ctx, ctx.cwd, sandboxConfigOverride);
-          if (!loadedConfig) return;
+        const sandboxConfigOverride = getStringFlag(pi, "sandbox-config");
+        const loadedConfig = loadSandboxConfigForContext(ctx, ctx.cwd, sandboxConfigOverride);
+        if (!loadedConfig) return;
 
-          sandboxConfigPaths = loadedConfig.paths;
-          const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
-          if (parseErrors.length > 0) {
-            notifySandboxConfigParseErrors(ctx, parseErrors);
-          }
-          sandboxConfig = loadedConfig.config;
-          runtimeConfig = await initializeSandboxRuntime(ctx, loadedConfig.config);
-          if (!runtimeConfig) return;
-          initializedNow = true;
+        sandboxConfigPaths = loadedConfig.paths;
+        notifySkippedUntrustedProjectConfigs(ctx);
+        const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
+        if (parseErrors.length > 0) {
+          notifySandboxConfigParseErrors(ctx, parseErrors);
         }
-
+        sandboxConfig = loadedConfig.config;
+        const runtimeConfig = await initializeSandboxRuntime(ctx, loadedConfig.config);
         if (!runtimeConfig) return;
 
-        if (initializedNow) {
-          setSandboxStatus(ctx, true, runtimeConfig, promptMode);
-        } else {
-          applyRuntimeConfigForSession(ctx, runtimeConfig, "active");
-        }
+        setSandboxStatus(ctx, true, runtimeConfig, promptMode);
 
         notify(ctx, "Sandbox enabled", "info");
         return;
@@ -2472,8 +2782,21 @@ export default function (pi: ExtensionAPI) {
           return;
         }
 
-        sandboxState = { status: "suspended", runtimeConfig: sandboxState.runtimeConfig };
+        sandboxState = { status: "suspended" };
+        pendingNetworkApprovals.clear();
         setSandboxStatus(ctx, false);
+
+        try {
+          await SandboxManager.reset();
+        } catch (error) {
+          notify(
+            ctx,
+            `Sandbox disabled, but cleanup failed: ${error instanceof Error ? error.message : error}`,
+            "warning",
+          );
+          return;
+        }
+
         notify(ctx, "Sandbox disabled", "info");
         return;
       }
@@ -2505,8 +2828,10 @@ export default function (pi: ExtensionAPI) {
           "",
           "  Filesystem:",
           `    Deny Read: ${runtimeConfig.filesystem.denyRead.join(", ") || "(none)"}`,
+          `    Allow Read: ${runtimeConfig.filesystem.allowRead?.join(", ") || "(none)"}`,
           `    Allow Write: ${runtimeConfig.filesystem.allowWrite.join(", ") || "(none)"}`,
           `    Deny Write: ${runtimeConfig.filesystem.denyWrite.join(", ") || "(none)"}`,
+          `    allowTempDirs: ${sandboxConfig?.filesystem.allowTempDirs ? "true" : "false"}`,
           `    allowGitConfig: ${runtimeConfig.filesystem.allowGitConfig ? "true" : "false"}`,
           `    allowGitCommonDir: ${sandboxConfig?.filesystem.allowGitCommonDir ? "true" : "false"}`,
           "",