tau-coding-agent 0.1.4 → 0.1.6

package/extensions/sandbox/index.ts

@@ -21,7 +21,12 @@
  *   "mode": "interactive",
  *   "network": {
  *     "allowedDomains": ["github.com", "*.github.com"],
- *     "deniedDomains": []
+ *     "deniedDomains": [],
+ *     "allowMachLookup": [
+ *       "com.apple.dnssd.service",
+ *       "com.apple.SystemConfiguration.configd",
+ *       "com.apple.SystemConfiguration.DNSConfiguration"
+ *     ]
  *   },
  *   "filesystem": {
  *     "denyRead": ["~/.ssh", "~/.aws"],
@@ -50,6 +55,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import {
   SandboxManager,
   type SandboxAskCallback,
@@ -63,12 +69,22 @@ import {
   globToRegex,
   normalizePathForSandbox,
 } from "@anthropic-ai/sandbox-runtime/dist/sandbox/sandbox-utils.js";
-import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { type BashOperations, createBashTool } from "@earendil-works/pi-coding-agent";
+import {
+  CONFIG_DIR_NAME,
+  createBashTool,
+  getAgentDir,
+  type BashOperations,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
 
 // --- Constants ---
 
 const DEFAULT_PROMPT_MODE: PromptMode = "interactive";
+const IS_MACOS = process.platform === "darwin";
+const MACOS_SANDBOX_SHELL = fileURLToPath(new URL("./macos-sandbox-shell.mjs", import.meta.url));
+const MAX_TIMEOUT_MS = 2_147_483_647;
+const MAX_TIMEOUT_SECONDS = MAX_TIMEOUT_MS / 1000;
 
 const DEFAULT_CONFIG: SandboxConfig = {
   enabled: true,
@@ -79,30 +95,43 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "127.0.0.1",
       "npmjs.org",
       "*.npmjs.org",
-      "registry.npmjs.org",
+      "npmjs.com",
+      "*.npmjs.com",
       "registry.yarnpkg.com",
+      "nodejs.org",
+      "*.nodejs.org",
       "pypi.org",
       "*.pypi.org",
       "pythonhosted.org",
       "*.pythonhosted.org",
       "crates.io",
       "*.crates.io",
+      "rustup.rs",
+      "*.rust-lang.org",
+      "repo.maven.apache.org",
+      "gradle.org",
+      "*.gradle.org",
       "proxy.golang.org",
       "sum.golang.org",
       "go.dev",
       "golang.org",
       "rubygems.org",
       "*.rubygems.org",
+      "nuget.org",
+      "*.nuget.org",
       "github.com",
       "*.github.com",
       "githubusercontent.com",
       "*.githubusercontent.com",
-      "api.github.com",
-      "raw.githubusercontent.com",
+      "gitlab.com",
+      "*.gitlab.com",
+      "bitbucket.org",
+      "*.bitbucket.org",
       "ghcr.io",
       "docker.io",
       "*.docker.io",
-      "production.cloudflare.docker.com",
+      "docker.com",
+      "*.docker.com",
       "sentry.io",
       "*.sentry.io",
       "datadoghq.com",
@@ -117,6 +146,8 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "*.openai.com",
       "chatgpt.com",
       "*.chatgpt.com",
+      "openrouter.ai",
+      "*.openrouter.ai",
       "google.com",
       "*.google.com",
       "googleapis.com",
@@ -129,26 +160,87 @@ const DEFAULT_CONFIG: SandboxConfig = {
       "*.doist.com",
     ],
     deniedDomains: [],
+    allowUnixSockets: ["$SSH_AUTH_SOCK"],
     allowLocalBinding: true,
+    allowMachLookup: [
+      "com.apple.dnssd.service",
+      "com.apple.SystemConfiguration.configd",
+      "com.apple.SystemConfiguration.DNSConfiguration",
+    ],
   },
   filesystem: {
     denyRead: ["~/.ssh", "~/.aws", "~/.gnupg"],
-    allowWrite: [".", "~/.cache", "~/.npm"],
-    denyWrite: [".env", ".env.*", "*.pem", "*.key"],
+    allowRead: ["~/.ssh/config", "~/.ssh/known_hosts", "~/.ssh/*.pub"],
+    allowWrite: [
+      ".",
+      "~/.cache",
+      "~/Library/Caches",
+      join(getAgentDir(), "*.lock"),
+      "~/**/__pycache__",
+      "~/**/__pycache__/*",
+      "~/.npm",
+      "~/.rustup",
+      "~/.cargo/registry",
+      "~/.cargo/git",
+      "~/.cargo/.package-cache",
+      "~/.cargo/.package-cache-mutate",
+      "~/.cargo/.global-cache",
+      "~/go/pkg",
+      "~/.m2/repository",
+      "~/.m2/wrapper/dists",
+      "~/.gradle",
+      "~/Library/Application Support/kotlin",
+      "~/.android",
+      "~/.bundle/cache",
+      "~/.gem/cache",
+      "~/.gem/specs",
+      "~/.nuget/packages",
+      "~/.local/share/NuGet/*-cache",
+      "~/.local/share/NuGet/*-cache/**",
+    ],
+    denyWrite: [
+      ".env",
+      ".env.*",
+      "*.pem",
+      "*.key",
+      "~/.gradle/gradle.properties",
+      "~/.gradle/init.gradle",
+      "~/.gradle/init.gradle.kts",
+      "~/.gradle/init.d",
+      "~/.android/adbkey",
+    ],
     allowTempDirs: true,
     allowGitConfig: true,
     allowGitCommonDir: true,
   },
+  ignoreViolations: {
+    "*": ["/__pycache__", "mach-lookup com.apple.usymptomsd"],
+  },
 };
 
 const STATUS_KEY = "sandbox";
 const SANDBOX_EVENT_LIMIT = 50;
-const METADATA_TRAVERSAL_PROCESSES = new Set(["find", "ls", "fd", "fdfind"]);
+const READ_TRAVERSAL_PROCESSES = new Set(["find", "ls", "fd", "fdfind"]);
 const GIT_FILESYSTEM_PATHS_CACHE = new Map<string, GitFilesystemPaths | null>();
+const ENV_PATH_REFERENCE_PATTERN = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_][A-Za-z0-9_]*))/g;
 
 // --- Types ---
 
 type PromptMode = "interactive" | "non-interactive";
+type ListOp = "add" | "remove";
+type SandboxEventOutcome = "blocked" | "allowed";
+type ViolationResolutionKind = "allow-retry" | "allow-adapt" | "deny";
+
+type ViolationResolution =
+  | {
+      kind: "allow-retry";
+      message: string;
+      retrySuccessMessage: string;
+      retryFailureMessage: string;
+      retrySkippedMessage: string;
+    }
+  | { kind: "allow-adapt"; message: string }
+  | { kind: "deny"; message: string };
 
 type SandboxBypassReason = "no-sandbox-flag" | "config-disabled" | "missing-dependencies";
 type SandboxBlockedReason = "unsupported-platform" | "init-failed";
@@ -158,7 +250,7 @@ type SandboxRunMode = "sandbox" | "user-disabled" | SandboxBypassReason | Sandbo
 type SandboxState =
   | { status: "pending" }
   | { status: "active"; runtimeConfig: SandboxRuntimeConfig }
-  | { status: "suspended"; runtimeConfig: SandboxRuntimeConfig }
+  | { status: "suspended" }
   | { status: "bypassed"; reason: SandboxBypassReason }
   | { status: "blocked"; reason: SandboxBlockedReason };
 
@@ -171,33 +263,32 @@ type SandboxConfig = Omit<SandboxRuntimeConfig, "filesystem"> & {
   };
 };
 
-type SandboxEventKind = "filesystem" | "network" | "init" | "runtime";
+type SandboxEventKind = "filesystem" | "network" | "mach-lookup" | "init" | "runtime";
 type SandboxEventReason =
   | "explicit-deny-read"
   | "explicit-deny-write"
   | "explicit-deny-domain"
   | "missing-allow-write"
   | "missing-allowed-domain"
+  | "missing-mach-lookup"
   | "missing-dependencies"
   | "unsupported-platform"
   | "init-failed"
+  | "runtime-protected-write"
   | "already-approved-still-failed"
   | "unknown";
-type SandboxEventOutcome = "blocked" | "allowed";
-type SandboxConfigPathStatus = "loaded" | "parse-error";
+type SandboxConfigPathStatus = "loaded" | "parse-error" | "skipped-untrusted";
 type SandboxConfigPathLabel = "Global" | "Project" | "Override";
 
 type PromptStatus = "completed" | "error";
 type UiLevel = "info" | "warning" | "error";
 
-type ListOp = "add" | "remove";
 type NetworkList = "allow" | "deny";
 type FilesystemList = "deny-read" | "allow-write" | "deny-write";
 
 type FilesystemViolationKind = "read" | "write" | "unknown";
 type FilesystemReadAccess = "metadata" | "data" | "unknown";
-type FilesystemViolationResolutionKind = "allow-retry" | "allow-adapt" | "deny";
-
+type FilesystemWriteAccess = "unlink" | "unknown";
 interface SandboxEvent {
   timestamp: number;
   kind: SandboxEventKind;
@@ -245,18 +336,12 @@ interface FilesystemViolation {
   path?: string;
   processName?: string;
   readAccess?: FilesystemReadAccess;
+  writeAccess?: FilesystemWriteAccess;
 }
 
-type FilesystemViolationResolution =
-  | {
-      kind: "allow-retry";
-      message: string;
-      retrySuccessMessage: string;
-      retryFailureMessage: string;
-      retrySkippedMessage: string;
-    }
-  | { kind: "allow-adapt"; message: string }
-  | { kind: "deny"; message: string };
+interface MachLookupViolation {
+  service: string;
+}
 
 // --- Helpers ---
 
@@ -307,6 +392,19 @@ function notify(ctx: ExtensionContext, text: string, level: UiLevel = "info"): v
   else console.log(text);
 }
 
+function announceSandboxState(pi: ExtensionAPI, ctx: ExtensionContext, enabled: boolean): void {
+  const text = `Sandbox ${enabled ? "enabled" : "disabled"}`;
+  notify(ctx, text, "info");
+  pi.sendMessage(
+    {
+      customType: "sandbox-state",
+      content: text,
+      display: false,
+    },
+    { triggerTurn: false },
+  );
+}
+
 function showHelp(ctx: ExtensionContext): void {
   const lines = [
     "Usage:",
@@ -316,6 +414,12 @@ function showHelp(ctx: ExtensionContext): void {
     "  /sandbox doctor",
     "  /sandbox mode <interactive|non-interactive>",
     "  /sandbox network <allow|deny> <add|remove> <domain>",
+    ...(IS_MACOS
+      ? [
+          "  /sandbox mach-lookup <add|remove> <service>",
+          "    Service rules support one trailing *; use * for all services.",
+        ]
+      : []),
     "  /sandbox filesystem <deny-read|allow-write|deny-write> <add|remove> <path>",
     "",
     "Startup flags:",
@@ -371,6 +475,7 @@ const SANDBOX_TOP_LEVEL_COMPLETIONS: CommandCompletionOption[] = [
   { value: "doctor", label: "doctor" },
   { value: "mode ", label: "mode" },
   { value: "network ", label: "network" },
+  ...(IS_MACOS ? [{ value: "mach-lookup ", label: "mach-lookup" }] : []),
   { value: "filesystem ", label: "filesystem" },
   { value: "help", label: "help" },
 ];
@@ -436,6 +541,37 @@ function getStringValueCompletions(
   }));
 }
 
+function getMachLookupArgumentCompletions(options: {
+  tokens: string[];
+  endsWithSpace: boolean;
+  runtimeConfig: SandboxRuntimeConfig | null;
+}): Array<{ value: string; label: string; description?: string }> | null {
+  const { tokens, endsWithSpace, runtimeConfig } = options;
+
+  if (tokens.length === 1 && endsWithSpace) {
+    return getCommandCompletions("mach-lookup ", "", SANDBOX_LIST_OPERATION_COMPLETIONS);
+  }
+  if (tokens.length === 2 && !endsWithSpace) {
+    return getCommandCompletions(
+      "mach-lookup ",
+      tokens[1] ?? "",
+      SANDBOX_LIST_OPERATION_COMPLETIONS,
+    );
+  }
+
+  if (tokens[1]?.toLowerCase() !== "remove") return null;
+
+  const values = runtimeConfig?.network.allowMachLookup ?? [];
+  const valueBase = "mach-lookup remove ";
+  if (tokens.length === 2 && endsWithSpace) {
+    return getStringValueCompletions(valueBase, "", values);
+  }
+  if (tokens.length === 3 && !endsWithSpace) {
+    return getStringValueCompletions(valueBase, tokens[2] ?? "", values);
+  }
+  return null;
+}
+
 function getSandboxArgumentCompletions(
   prefix: string,
   runtimeConfig: SandboxRuntimeConfig | null,
@@ -499,6 +635,10 @@ function getSandboxArgumentCompletions(
     return null;
   }
 
+  if (subcommand === "mach-lookup" && IS_MACOS) {
+    return getMachLookupArgumentCompletions({ tokens, endsWithSpace, runtimeConfig });
+  }
+
   if (subcommand === "filesystem") {
     if (tokens.length === 1 && endsWithSpace) {
       return getCommandCompletions("filesystem ", "", SANDBOX_FILESYSTEM_LIST_COMPLETIONS);
@@ -575,12 +715,7 @@ function formatSandboxConfigLoadErrorMessage(
   return `Could not read sandbox override config ${path}: ${detail ?? "unknown error"}`;
 }
 
-function coerceStringArray(value: unknown, fallback: string[], field: string): string[] {
-  if (!Array.isArray(value)) {
-    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
-    return [...fallback];
-  }
-
+function cleanStringArray(value: unknown[], field: string): string[] {
   const cleaned = value
     .filter((item): item is string => typeof item === "string")
     .map((item) => item.trim())
@@ -594,6 +729,30 @@ function coerceStringArray(value: unknown, fallback: string[], field: string): s
   return cleaned;
 }
 
+function coerceStringArray(value: unknown, fallback: string[], field: string): string[] {
+  if (!Array.isArray(value)) {
+    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
+    return [...fallback];
+  }
+
+  return cleanStringArray(value, field);
+}
+
+function coerceOptionalStringArray(
+  value: unknown,
+  fallback: string[] | undefined,
+  field: string,
+): string[] | undefined {
+  if (value === undefined) return fallback ? [...fallback] : undefined;
+
+  if (!Array.isArray(value)) {
+    console.error(`Warning: Expected ${field} to be a string[]; using defaults.`);
+    return fallback ? [...fallback] : undefined;
+  }
+
+  return cleanStringArray(value, field);
+}
+
 function finalizeConfig(config: SandboxConfig): SandboxConfig {
   return {
     ...config,
@@ -611,6 +770,16 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.network.deniedDomains,
         "network.deniedDomains",
       ),
+      allowMachLookup: coerceStringArray(
+        config.network?.allowMachLookup,
+        DEFAULT_CONFIG.network.allowMachLookup ?? [],
+        "network.allowMachLookup",
+      ),
+      allowUnixSockets: coerceOptionalStringArray(
+        config.network?.allowUnixSockets,
+        DEFAULT_CONFIG.network.allowUnixSockets,
+        "network.allowUnixSockets",
+      ),
     },
     filesystem: {
       ...config.filesystem,
@@ -619,6 +788,11 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.filesystem.denyRead,
         "filesystem.denyRead",
       ),
+      allowRead: coerceOptionalStringArray(
+        config.filesystem?.allowRead,
+        DEFAULT_CONFIG.filesystem.allowRead,
+        "filesystem.allowRead",
+      ),
       allowWrite: coerceStringArray(
         config.filesystem?.allowWrite,
         DEFAULT_CONFIG.filesystem.allowWrite,
@@ -680,13 +854,17 @@ function loadOverrideConfig(cwd: string, overrideConfigPath: string): LoadedSand
   };
 }
 
-function loadConfig(cwd: string, overrideConfigPath?: string): LoadedSandboxConfig {
+function loadConfig(
+  cwd: string,
+  overrideConfigPath?: string,
+  options: { projectTrusted?: boolean } = {},
+): LoadedSandboxConfig {
   if (overrideConfigPath) {
     return loadOverrideConfig(cwd, overrideConfigPath);
   }
 
-  const projectConfigPath = join(cwd, ".pi", "sandbox.json");
-  const globalConfigPath = join(homedir(), ".pi", "agent", "sandbox.json");
+  const projectConfigPath = join(cwd, CONFIG_DIR_NAME, "sandbox.json");
+  const globalConfigPath = join(getAgentDir(), "sandbox.json");
 
   let globalConfig: Partial<SandboxConfig> = {};
   let projectConfig: Partial<SandboxConfig> = {};
@@ -703,12 +881,16 @@ function loadConfig(cwd: string, overrideConfigPath?: string): LoadedSandboxConf
   }
 
   if (existsSync(projectConfigPath)) {
-    try {
-      projectConfig = JSON.parse(readFileSync(projectConfigPath, "utf-8"));
-      paths.push({ label: "Project", path: projectConfigPath, status: "loaded" });
-    } catch (e) {
-      paths.push({ label: "Project", path: projectConfigPath, status: "parse-error" });
-      console.error(`Warning: Could not parse ${projectConfigPath}: ${e}`);
+    if (options.projectTrusted !== true) {
+      paths.push({ label: "Project", path: projectConfigPath, status: "skipped-untrusted" });
+    } else {
+      try {
+        projectConfig = JSON.parse(readFileSync(projectConfigPath, "utf-8"));
+        paths.push({ label: "Project", path: projectConfigPath, status: "loaded" });
+      } catch (e) {
+        paths.push({ label: "Project", path: projectConfigPath, status: "parse-error" });
+        console.error(`Warning: Could not parse ${projectConfigPath}: ${e}`);
+      }
     }
   }
 
@@ -773,15 +955,128 @@ function getTemporaryWritePaths(): string[] {
   return cachedTemporaryWritePaths;
 }
 
+function deduplicateStrings(values: string[]): string[] {
+  return Array.from(new Set(values));
+}
+
+function deduplicateOptionalStrings(values: string[] | undefined): string[] | undefined {
+  return values ? deduplicateStrings(values) : undefined;
+}
+
+function containsControlCharacter(value: string): boolean {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code <= 0x1f || (code >= 0x7f && code <= 0x9f) || code === 0x2028 || code === 0x2029) {
+      return true;
+    }
+  }
+
+  return false;
+}
+
+function expandPathConfigEntry(value: string, field: string): string | null {
+  const source = value.trim();
+  if (!source) return null;
+
+  const missingEnvNames = new Set<string>();
+  const expanded = source.replace(
+    ENV_PATH_REFERENCE_PATTERN,
+    (_match, bracedName: string | undefined, bareName: string | undefined) => {
+      const envName = bracedName ?? bareName;
+      const envValue = envName ? (process.env[envName]?.trim() ?? "") : "";
+      if (!envValue) {
+        if (envName) missingEnvNames.add(envName);
+        return "";
+      }
+      return envValue;
+    },
+  );
+
+  if (missingEnvNames.size > 0) {
+    const names = Array.from(missingEnvNames).join(", ");
+    const label = missingEnvNames.size === 1 ? "environment variable" : "environment variables";
+    const verb = missingEnvNames.size === 1 ? "is" : "are";
+    console.error(
+      `Warning: Ignoring ${field} entry because ${label} ${names} ${verb} unset or empty.`,
+    );
+    return null;
+  }
+
+  if (containsControlCharacter(expanded)) {
+    console.error(
+      `Warning: Ignoring ${field} entry because the expanded path contains control characters.`,
+    );
+    return null;
+  }
+
+  return expanded;
+}
+
+function expandPathConfigList(values: string[] | undefined, field: string): string[] | undefined {
+  if (!values) return undefined;
+
+  return values
+    .map((value) => expandPathConfigEntry(value, field))
+    .filter((value): value is string => value !== null);
+}
+
+function expandMitmProxyPathConfig(
+  mitmProxy: SandboxRuntimeConfig["network"]["mitmProxy"],
+): SandboxRuntimeConfig["network"]["mitmProxy"] {
+  if (!mitmProxy) return undefined;
+  if (!isPlainObject(mitmProxy) || typeof mitmProxy.socketPath !== "string") return mitmProxy;
+
+  const socketPath = expandPathConfigEntry(mitmProxy.socketPath, "network.mitmProxy.socketPath");
+  if (!socketPath) {
+    console.error("Warning: Disabling network.mitmProxy because its socketPath did not expand.");
+    return undefined;
+  }
+
+  return { ...mitmProxy, socketPath } as SandboxRuntimeConfig["network"]["mitmProxy"];
+}
+
+function expandNetworkPathConfig(
+  network: SandboxRuntimeConfig["network"],
+): SandboxRuntimeConfig["network"] {
+  return {
+    ...network,
+    allowUnixSockets: expandPathConfigList(network.allowUnixSockets, "network.allowUnixSockets"),
+    mitmProxy: expandMitmProxyPathConfig(network.mitmProxy),
+  };
+}
+
+function expandFilesystemPathConfig(
+  filesystem: SandboxRuntimeConfig["filesystem"],
+): SandboxRuntimeConfig["filesystem"] {
+  return {
+    ...filesystem,
+    denyRead: expandPathConfigList(filesystem.denyRead, "filesystem.denyRead") ?? [],
+    allowRead: expandPathConfigList(filesystem.allowRead, "filesystem.allowRead"),
+    allowWrite: expandPathConfigList(filesystem.allowWrite, "filesystem.allowWrite") ?? [],
+    denyWrite: expandPathConfigList(filesystem.denyWrite, "filesystem.denyWrite") ?? [],
+  };
+}
+
 function toRuntimeConfig(config: SandboxConfig): SandboxRuntimeConfig {
   const { allowGitCommonDir: _allowGitCommonDir, allowTempDirs, ...filesystem } = config.filesystem;
+  const expandedNetwork = expandNetworkPathConfig(config.network);
+  const expandedFilesystem = expandFilesystemPathConfig(filesystem);
   const allowWrite = allowTempDirs
-    ? Array.from(new Set([...filesystem.allowWrite, ...getTemporaryWritePaths()]))
-    : filesystem.allowWrite;
+    ? [...expandedFilesystem.allowWrite, ...getTemporaryWritePaths()]
+    : expandedFilesystem.allowWrite;
 
   return {
-    network: config.network,
-    filesystem: { ...filesystem, allowWrite },
+    network: {
+      ...expandedNetwork,
+      allowUnixSockets: deduplicateOptionalStrings(expandedNetwork.allowUnixSockets),
+    },
+    filesystem: {
+      ...expandedFilesystem,
+      denyRead: deduplicateStrings(expandedFilesystem.denyRead),
+      allowRead: deduplicateOptionalStrings(expandedFilesystem.allowRead),
+      allowWrite: deduplicateStrings(allowWrite),
+      denyWrite: deduplicateStrings(expandedFilesystem.denyWrite),
+    },
     ignoreViolations: config.ignoreViolations,
     enableWeakerNestedSandbox: config.enableWeakerNestedSandbox,
     enableWeakerNetworkIsolation: config.enableWeakerNetworkIsolation,
@@ -818,6 +1113,19 @@ function inferSandboxRuleMatch(path: string, rules: string[], cwd?: string): str
   return null;
 }
 
+function matchesSandboxRuleExactly(path: string, rule: string, cwd?: string): boolean {
+  if (containsGlobChars(rule)) return false;
+  return normalizeSandboxPath(path) === normalizeSandboxPath(rule, cwd);
+}
+
+function inferExactSandboxRuleMatch(path: string, rules: string[], cwd?: string): string | null {
+  for (const rule of rules) {
+    if (matchesSandboxRuleExactly(path, rule, cwd)) return rule;
+  }
+
+  return null;
+}
+
 function isSandboxWritablePath(
   runtimeConfig: SandboxRuntimeConfig,
   path: string,
@@ -827,6 +1135,42 @@ function isSandboxWritablePath(
   return inferSandboxRuleMatch(path, runtimeConfig.filesystem.denyWrite, cwd) === null;
 }
 
+function isRuntimeProtectedWriteViolation(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  violation: FilesystemViolation,
+  cwd?: string,
+): boolean {
+  if (
+    !runtimeConfig ||
+    runtimeConfig.filesystem.disabled ||
+    !violation.path ||
+    violation.kind !== "write"
+  ) {
+    return false;
+  }
+
+  return isSandboxWritablePath(runtimeConfig, violation.path, cwd);
+}
+
+function getRuntimeProtectedWriteViolations(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  violations: FilesystemViolation[],
+  cwd?: string,
+): FilesystemViolation[] {
+  const violationsByPath = new Map<string, FilesystemViolation>();
+
+  for (const violation of violations) {
+    if (!isRuntimeProtectedWriteViolation(runtimeConfig, violation, cwd) || !violation.path) {
+      continue;
+    }
+    if (!violationsByPath.has(violation.path)) {
+      violationsByPath.set(violation.path, violation);
+    }
+  }
+
+  return Array.from(violationsByPath.values());
+}
+
 function resolveGitFilesystemPaths(cwd: string): GitFilesystemPaths | null {
   if (GIT_FILESYSTEM_PATHS_CACHE.has(cwd)) {
     return GIT_FILESYSTEM_PATHS_CACHE.get(cwd) ?? null;
@@ -910,8 +1254,8 @@ function extractAppendedSandboxAnnotation(
       : violationLines;
   if (newViolationLines.length === 0) return "";
 
-  // Filesystem and network sandbox violations are summarized elsewhere via compact
-  // extension messages, so suppress the verbose synthetic annotation block.
+  // Sandbox violations are summarized elsewhere via compact extension messages,
+  // so suppress the verbose synthetic annotation block.
   return "";
 }
 
@@ -957,7 +1301,60 @@ function extractPathLikeValue(text: string): string | undefined {
 
 function extractViolationProcessName(line: string): string | undefined {
   const match = line.match(/^([^\s(]+)\(/);
-  return match?.[1]?.trim() || undefined;
+  const processName = match?.[1]?.trim();
+  if (!processName) return undefined;
+  return processName.split("/").pop() || processName;
+}
+
+function detectMachLookupViolationFromLine(line: string): MachLookupViolation | null {
+  const match = line.match(/\bdeny\(\d+\)\s+mach-lookup\s+([^\s()"'*]+)/i);
+  const service = match?.[1];
+  return service ? { service } : null;
+}
+
+function detectMachLookupViolations(lines: string[]): MachLookupViolation[] {
+  const violationsByService = new Map<string, MachLookupViolation>();
+
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const violation = detectMachLookupViolationFromLine(lines[index]);
+    if (violation && !violationsByService.has(violation.service)) {
+      violationsByService.set(violation.service, violation);
+    }
+  }
+
+  return Array.from(violationsByService.values());
+}
+
+function isValidMachLookupRule(rule: string): boolean {
+  const trimmed = rule.trim();
+  if (!trimmed || /\s/.test(trimmed)) return false;
+
+  const prefix = trimmed.endsWith("*") ? trimmed.slice(0, -1) : trimmed;
+  return !prefix.includes("*");
+}
+
+function matchesMachLookupRule(service: string, rule: string): boolean {
+  if (rule === "*") return true;
+  if (rule.endsWith("*")) return service.startsWith(rule.slice(0, -1));
+  return service === rule;
+}
+
+function mutateMachLookupAllowList(
+  runtimeConfig: SandboxRuntimeConfig,
+  op: ListOp,
+  service: string,
+): boolean {
+  runtimeConfig.network.allowMachLookup ??= [];
+  return mutateStringList(runtimeConfig.network.allowMachLookup, op, service);
+}
+
+function isMachLookupAlreadyAllowed(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  service: string,
+): boolean {
+  return (runtimeConfig?.network.allowMachLookup ?? []).some((rule) =>
+    matchesMachLookupRule(service, rule),
+  );
 }
 
 function detectFilesystemViolationFromLine(line: string): FilesystemViolation | null {
@@ -966,8 +1363,12 @@ function detectFilesystemViolationFromLine(line: string): FilesystemViolation |
   const path = extractPathLikeValue(line);
   const processName = extractViolationProcessName(line);
 
+  if (lower.includes("file-write-unlink")) {
+    return { kind: "write", path, processName, writeAccess: "unlink" };
+  }
+
   if (lower.includes("file-write")) {
-    return { kind: "write", path, processName };
+    return { kind: "write", path, processName, writeAccess: "unknown" };
   }
 
   if (lower.includes("file-read-metadata")) {
@@ -989,6 +1390,7 @@ function detectFilesystemViolations(
   output: string,
   fallbackOutput: string = output,
   skipViolationLines = 0,
+  allowOutputFallback = true,
 ): FilesystemViolation[] {
   const violations: FilesystemViolation[] = [];
   const allViolationLines = extractSandboxViolationLines(output);
@@ -1002,7 +1404,7 @@ function detectFilesystemViolations(
     if (violation) violations.push(violation);
   }
 
-  if (violations.length > 0) return violations;
+  if (violations.length > 0 || !allowOutputFallback) return violations;
 
   const hasEperm = /\bEPERM\b/i.test(fallbackOutput);
   const hasOperationNotPermitted = /(?:^|\n)[^\n]*Operation not permitted(?:$|\n)/i.test(
@@ -1016,19 +1418,30 @@ function detectFilesystemViolations(
   return violations;
 }
 
-function isMetadataTraversalViolation(
+function isTraversalViolation(
   runtimeConfig: SandboxRuntimeConfig | null,
   violation: FilesystemViolation,
   cwd?: string,
 ): boolean {
-  if (!runtimeConfig || violation.kind !== "read" || violation.readAccess !== "metadata")
-    return false;
-  if (!violation.path || !METADATA_TRAVERSAL_PROCESSES.has(violation.processName ?? ""))
-    return false;
-  return inferSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null;
+  if (!runtimeConfig || !violation.path) return false;
+  if (!READ_TRAVERSAL_PROCESSES.has(violation.processName ?? "")) return false;
+
+  if (violation.kind === "read") {
+    return inferSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null;
+  }
+
+  if (violation.kind !== "write" || violation.writeAccess !== "unlink") return false;
+
+  // Seatbelt can emit file-write-unlink checks for protected directory roots
+  // while traversal commands enumerate them. Only exact protected roots are
+  // treated as skipped traversal so writes under protected trees still prompt.
+  return (
+    inferExactSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyRead, cwd) !== null ||
+    inferExactSandboxRuleMatch(violation.path, runtimeConfig.filesystem.denyWrite, cwd) !== null
+  );
 }
 
-function getMetadataTraversalPaths(options: {
+function getTraversalPaths(options: {
   runtimeConfig: SandboxRuntimeConfig | null;
   output: string;
   cwd?: string;
@@ -1047,7 +1460,7 @@ function getMetadataTraversalPaths(options: {
   const skippedPaths: string[] = [];
   for (const line of violationLines) {
     const violation = detectFilesystemViolationFromLine(line);
-    if (!violation || !isMetadataTraversalViolation(runtimeConfig, violation, cwd)) {
+    if (!violation || !isTraversalViolation(runtimeConfig, violation, cwd)) {
       return null;
     }
     if (violation.path && !skippedPaths.includes(violation.path)) {
@@ -1058,7 +1471,7 @@ function getMetadataTraversalPaths(options: {
   return skippedPaths.length > 0 ? skippedPaths : null;
 }
 
-function formatMetadataTraversalNotice(paths: string[]): string {
+function formatTraversalNotice(paths: string[]): string {
   if (paths.length === 0) return "";
 
   const visiblePaths = paths.slice(0, 3).join(", ");
@@ -1067,6 +1480,22 @@ function formatMetadataTraversalNotice(paths: string[]): string {
   return `[sandbox] Continued after skipping protected ${label}: ${visiblePaths}${suffix}`;
 }
 
+function formatRuntimeProtectedWriteNotice(
+  violations: FilesystemViolation[],
+  continued: boolean,
+): string {
+  const paths = violations
+    .map((violation) => violation.path)
+    .filter((path): path is string => path !== undefined);
+  if (paths.length === 0) return "";
+
+  const visiblePaths = paths.slice(0, 3).join(", ");
+  const suffix = paths.length > 3 ? ", ..." : "";
+  const label = paths.length === 1 ? "write" : "writes";
+  const prefix = continued ? "Continued after blocking" : "Blocked";
+  return `[sandbox] ${prefix} runtime-protected ${label} that sandbox config cannot override: ${visiblePaths}${suffix}`;
+}
+
 function escapeSlashCommandArg(value: string): string {
   if (/^[a-zA-Z0-9_./:@%+\-~]+$/.test(value)) return value;
   return JSON.stringify(value);
@@ -1187,56 +1616,61 @@ function formatFilesystemViolationSummary(violation: FilesystemViolation): strin
   return "[sandbox] Blocked filesystem access (EPERM).";
 }
 
-const FILESYSTEM_ALLOW_RETRY_OPTION = "Allow and retry now";
-const FILESYSTEM_ALLOW_ADAPT_OPTION = "Allow but adapt for side-effects";
-const FILESYSTEM_DENY_OPTION = "Deny";
+const VIOLATION_ALLOW_RETRY_OPTION = "Allow and retry now";
+const VIOLATION_ALLOW_ADAPT_OPTION = "Allow but adapt for side-effects";
+const VIOLATION_DENY_OPTION = "Deny";
 
-function getFilesystemPromptOptions(
-  _violation: FilesystemViolation,
-  autoRetryAvailable: boolean,
-): string[] {
+function getViolationPromptOptions(autoRetryAvailable: boolean): string[] {
   if (!autoRetryAvailable) {
-    return [FILESYSTEM_ALLOW_ADAPT_OPTION, FILESYSTEM_DENY_OPTION];
+    return [VIOLATION_ALLOW_ADAPT_OPTION, VIOLATION_DENY_OPTION];
   }
 
-  return [FILESYSTEM_ALLOW_RETRY_OPTION, FILESYSTEM_ALLOW_ADAPT_OPTION, FILESYSTEM_DENY_OPTION];
+  return [VIOLATION_ALLOW_RETRY_OPTION, VIOLATION_ALLOW_ADAPT_OPTION, VIOLATION_DENY_OPTION];
 }
 
-function parseFilesystemPromptSelection(
+function parseViolationPromptSelection(
   selection: string | undefined,
   autoRetryAvailable: boolean,
-): FilesystemViolationResolutionKind {
-  if (selection === FILESYSTEM_ALLOW_ADAPT_OPTION) return "allow-adapt";
-  if (selection === FILESYSTEM_ALLOW_RETRY_OPTION && autoRetryAvailable) return "allow-retry";
+): ViolationResolutionKind {
+  if (selection === VIOLATION_ALLOW_ADAPT_OPTION) return "allow-adapt";
+  if (selection === VIOLATION_ALLOW_RETRY_OPTION && autoRetryAvailable) return "allow-retry";
   return "deny";
 }
 
-function formatFilesystemAllowRetryMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nGranting access and retrying the command per user request...\n\n";
+function formatViolationAllowRetryMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nGranting access and retrying the command per user request...\n\n`;
 }
 
-function formatFilesystemAllowAdaptMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nAccess granted for this session. Retry the command manually if appropriate.";
+function formatViolationAllowAdaptMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session. Retry the command manually if appropriate.`;
 }
 
-function formatFilesystemDeniedMessage(_target: string): string {
-  return "\nSandbox blocked access.\n\nAccess remains denied for this session.";
+function formatViolationDeniedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess remains denied for this session.`;
 }
 
-function formatFilesystemAlreadyAllowedMessage(_target: string): string {
-  return "\nSandbox blocked access again after permission had already been granted. The remaining failure may be unrelated to sandbox policy.";
+function formatViolationAlreadyAllowedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess had already been granted for this session. The remaining failure may be unrelated to sandbox policy.`;
 }
 
-function formatFilesystemRetrySucceededMessage(_target: string): string {
-  return "";
+function formatViolationRetrySucceededMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session and the command was retried successfully.`;
 }
 
-function formatFilesystemRetryFailedMessage(_target: string): string {
-  return "\nAccess granted and command retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.";
+function formatViolationRetryFailedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session and the command was retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.`;
 }
 
-function formatFilesystemRetrySkippedMessage(_target: string): string {
-  return "\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.";
+function formatViolationRetrySkippedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.`;
+}
+
+function formatFilesystemBlockedTarget(target: string): string {
+  return `Sandbox blocked filesystem ${target}.`;
+}
+
+function formatMachLookupBlockedTarget(service: string): string {
+  return `Sandbox blocked access to macOS service ${service}.`;
 }
 
 function appendOutputPostamble(postamble: string, addition: string, output: string): string {
@@ -1262,7 +1696,7 @@ async function handleFilesystemViolation(options: {
   rawOutput: string;
   command: string;
   cwd?: string;
-  pendingPrompts?: Map<string, Promise<FilesystemViolationResolution | null>>;
+  pendingPrompts?: Map<string, Promise<ViolationResolution | null>>;
   applyRuntimeConfigForSession?: (
     ctx: ExtensionContext,
     runtimeConfig: SandboxRuntimeConfig,
@@ -1270,7 +1704,9 @@ async function handleFilesystemViolation(options: {
   existingViolationCount?: number;
   recordEvent?: (event: SandboxEvent) => void;
   autoRetryAvailable?: boolean;
-}): Promise<FilesystemViolationResolution | null> {
+  runtimeProtectedWriteViolations?: FilesystemViolation[];
+  allowOutputFallback?: boolean;
+}): Promise<ViolationResolution | null> {
   const {
     pi,
     ctx,
@@ -1285,19 +1721,35 @@ async function handleFilesystemViolation(options: {
     existingViolationCount,
     recordEvent,
     autoRetryAvailable = true,
+    runtimeProtectedWriteViolations = [],
+    allowOutputFallback = true,
   } = options;
-  const violations = detectFilesystemViolations(output, rawOutput, existingViolationCount ?? 0);
-  if (violations.length === 0) return null;
+  const violations = detectFilesystemViolations(
+    output,
+    rawOutput,
+    existingViolationCount ?? 0,
+    allowOutputFallback,
+  );
+  const runtimeProtectedWritePaths = new Set(
+    runtimeProtectedWriteViolations.map((violation) => violation.path).filter(Boolean),
+  );
+  const actionableViolations = violations.filter((violation) => {
+    const isRuntimeProtectedWrite =
+      violation.kind !== "read" && runtimeProtectedWritePaths.has(violation.path);
+    return !isRuntimeProtectedWrite && !isTraversalViolation(runtimeConfig, violation, cwd);
+  });
+  if (actionableViolations.length === 0) return null;
 
   const violation =
-    violations.find((candidate) => {
+    actionableViolations.find((candidate) => {
       const candidateAction = buildFilesystemAllowAction(runtimeConfig, candidate, cwd);
       if (!candidateAction) return false;
       return !isFilesystemAllowActionAlreadyApplied(runtimeConfig, candidateAction);
-    }) ?? violations[0];
+    }) ?? actionableViolations[0];
 
   const summary = formatFilesystemViolationSummary(violation);
   const target = describeFilesystemViolationTarget(violation);
+  const blockedTarget = formatFilesystemBlockedTarget(target);
   const allowAction = buildFilesystemAllowAction(runtimeConfig, violation, cwd);
   const allowCommand = allowAction ? buildFilesystemAllowCommand(allowAction) : null;
   const alreadyApproved = allowAction
@@ -1336,25 +1788,25 @@ async function handleFilesystemViolation(options: {
 
   if (alreadyApproved) {
     recordFilesystemEvent("blocked");
-    return { kind: "allow-adapt", message: formatFilesystemAlreadyAllowedMessage(target) };
+    return { kind: "allow-adapt", message: formatViolationAlreadyAllowedMessage(blockedTarget) };
   }
 
   const promptKey = `${allowCommand}:${autoRetryAvailable ? "retry" : "adapt"}`;
   const existingPrompt = pendingPrompts?.get(promptKey);
   if (existingPrompt) return existingPrompt;
 
-  const promptTask: Promise<FilesystemViolationResolution | null> = (async () => {
+  const promptTask: Promise<ViolationResolution | null> = (async () => {
     try {
       const selection = await withPromptSignal(pi, () =>
         ctx.ui.select(
           `Sandbox blocked filesystem ${target}`,
-          getFilesystemPromptOptions(violation, autoRetryAvailable),
+          getViolationPromptOptions(autoRetryAvailable),
         ),
       );
-      const decision = parseFilesystemPromptSelection(selection, autoRetryAvailable);
+      const decision = parseViolationPromptSelection(selection, autoRetryAvailable);
       if (decision === "deny") {
         recordFilesystemEvent("blocked");
-        return { kind: "deny", message: formatFilesystemDeniedMessage(target) };
+        return { kind: "deny", message: formatViolationDeniedMessage(blockedTarget) };
       }
 
       const nextConfig = cloneRuntimeConfig(runtimeConfig);
@@ -1368,18 +1820,163 @@ async function handleFilesystemViolation(options: {
       if (decision === "allow-retry") {
         return {
           kind: "allow-retry",
-          message: formatFilesystemAllowRetryMessage(target),
-          retrySuccessMessage: formatFilesystemRetrySucceededMessage(target),
-          retryFailureMessage: formatFilesystemRetryFailedMessage(target),
-          retrySkippedMessage: formatFilesystemRetrySkippedMessage(target),
+          message: formatViolationAllowRetryMessage(blockedTarget),
+          retrySuccessMessage: formatViolationRetrySucceededMessage(blockedTarget),
+          retryFailureMessage: formatViolationRetryFailedMessage(blockedTarget),
+          retrySkippedMessage: formatViolationRetrySkippedMessage(blockedTarget),
+        };
+      }
+
+      return {
+        kind: "allow-adapt",
+        message: changed
+          ? formatViolationAllowAdaptMessage(blockedTarget)
+          : formatViolationAlreadyAllowedMessage(blockedTarget),
+      };
+    } catch {
+      return null;
+    }
+  })();
+
+  if (!pendingPrompts) return promptTask;
+
+  pendingPrompts.set(promptKey, promptTask);
+  try {
+    return await promptTask;
+  } finally {
+    pendingPrompts.delete(promptKey);
+  }
+}
+
+function buildMachLookupAllowCommand(service: string): string {
+  return `/sandbox mach-lookup add ${escapeSlashCommandArg(service)}`;
+}
+
+function formatMachLookupViolationSummary(service: string): string {
+  return `[sandbox] Blocked macOS service lookup: ${service}`;
+}
+
+function describeMachLookupEventSummary(
+  reason: SandboxEventReason,
+  outcome: SandboxEventOutcome,
+): string {
+  if (outcome === "allowed") return "user allowed macOS service lookup for this session";
+  if (reason === "already-approved-still-failed") {
+    return "macOS service lookup was previously allowed for this session but is still failing";
+  }
+  return "macOS service lookup is not in the allowed service list";
+}
+
+async function handleMachLookupViolation(options: {
+  pi: ExtensionAPI;
+  ctx: ExtensionContext | null;
+  promptMode: PromptMode;
+  runtimeConfig: SandboxRuntimeConfig;
+  violations: MachLookupViolation[];
+  command: string;
+  cwd?: string;
+  pendingPrompts?: Map<string, Promise<ViolationResolution | null>>;
+  applyRuntimeConfigForSession?: (
+    ctx: ExtensionContext,
+    runtimeConfig: SandboxRuntimeConfig,
+  ) => void;
+  recordEvent?: (event: SandboxEvent) => void;
+  autoRetryAvailable?: boolean;
+}): Promise<ViolationResolution | null> {
+  const {
+    pi,
+    ctx,
+    promptMode,
+    runtimeConfig,
+    violations,
+    command,
+    cwd,
+    pendingPrompts,
+    applyRuntimeConfigForSession,
+    recordEvent,
+    autoRetryAvailable = true,
+  } = options;
+  if (violations.length === 0) return null;
+
+  const violation =
+    violations.find((candidate) => !isMachLookupAlreadyAllowed(runtimeConfig, candidate.service)) ??
+    violations[0];
+  const { service } = violation;
+  const blockedTarget = formatMachLookupBlockedTarget(service);
+  const allowCommand = buildMachLookupAllowCommand(service);
+  const alreadyApproved = isMachLookupAlreadyAllowed(runtimeConfig, service);
+  const eventReason: SandboxEventReason = alreadyApproved
+    ? "already-approved-still-failed"
+    : "missing-mach-lookup";
+
+  const recordMachLookupEvent = (outcome: SandboxEventOutcome): void => {
+    recordEvent?.({
+      timestamp: Date.now(),
+      kind: "mach-lookup",
+      outcome,
+      reason: eventReason,
+      target: service,
+      command,
+      cwd,
+      summary: describeMachLookupEventSummary(eventReason, outcome),
+      suggestedCommand: outcome === "blocked" && !alreadyApproved ? allowCommand : undefined,
+    });
+  };
+
+  if (promptMode === "non-interactive" || !ctx?.hasUI) {
+    recordMachLookupEvent("blocked");
+    return {
+      kind: "deny",
+      message: `${formatMachLookupViolationSummary(service)}\n[sandbox] To temporarily allow for this session, run: ${allowCommand}`,
+    };
+  }
+
+  if (alreadyApproved) {
+    recordMachLookupEvent("blocked");
+    return { kind: "allow-adapt", message: formatViolationAlreadyAllowedMessage(blockedTarget) };
+  }
+
+  const promptKey = `${allowCommand}:${autoRetryAvailable ? "retry" : "adapt"}`;
+  const existingPrompt = pendingPrompts?.get(promptKey);
+  if (existingPrompt) return existingPrompt;
+
+  const promptTask: Promise<ViolationResolution | null> = (async () => {
+    try {
+      const selection = await withPromptSignal(pi, () =>
+        ctx.ui.select(
+          `Sandbox blocked access to macOS service ${service}`,
+          getViolationPromptOptions(autoRetryAvailable),
+        ),
+      );
+      const decision = parseViolationPromptSelection(selection, autoRetryAvailable);
+      if (decision === "deny") {
+        recordMachLookupEvent("blocked");
+        return { kind: "deny", message: formatViolationDeniedMessage(blockedTarget) };
+      }
+
+      const nextConfig = cloneRuntimeConfig(runtimeConfig);
+      const changed = mutateMachLookupAllowList(nextConfig, "add", service);
+      if (changed) {
+        applyRuntimeConfigForSession?.(ctx, nextConfig);
+      }
+
+      recordMachLookupEvent("allowed");
+
+      if (decision === "allow-retry") {
+        return {
+          kind: "allow-retry",
+          message: formatViolationAllowRetryMessage(blockedTarget),
+          retrySuccessMessage: formatViolationRetrySucceededMessage(blockedTarget),
+          retryFailureMessage: formatViolationRetryFailedMessage(blockedTarget),
+          retrySkippedMessage: formatViolationRetrySkippedMessage(blockedTarget),
         };
       }
 
       return {
         kind: "allow-adapt",
         message: changed
-          ? formatFilesystemAllowAdaptMessage(target)
-          : formatFilesystemAlreadyAllowedMessage(target),
+          ? formatViolationAllowAdaptMessage(blockedTarget)
+          : formatViolationAlreadyAllowedMessage(blockedTarget),
       };
     } catch {
       return null;
@@ -1413,17 +2010,20 @@ interface BashAttemptResult {
   exitCode: number | null;
   combinedOutput: string;
   interruptedByFilesystemViolation: boolean;
+  runtimeProtectedWriteViolations: FilesystemViolation[];
 }
 
 interface ProcessedSandboxAttempt {
   exitCode: number | null;
   postamble: string;
-  resolution: FilesystemViolationResolution | null;
+  resolution: ViolationResolution | null;
+  runtimeProtectedWriteViolations: FilesystemViolation[];
 }
 
 interface PreparedSandboxAttempt {
   attempt: BashAttemptResult;
   existingViolationCount: number;
+  runtimeConfig: SandboxRuntimeConfig | null;
 }
 
 function killProcessGroup(
@@ -1489,7 +2089,8 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     applyRuntimeConfigForSession,
     recordEvent,
   } = options;
-  const pendingFilesystemPrompts = new Map<string, Promise<FilesystemViolationResolution | null>>();
+  const pendingFilesystemPrompts = new Map<string, Promise<ViolationResolution | null>>();
+  const pendingMachLookupPrompts = new Map<string, Promise<ViolationResolution | null>>();
 
   let executionQueue: Promise<void> = Promise.resolve();
 
@@ -1502,10 +2103,17 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     return run;
   }
 
+  function withSandboxDefaultEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv {
+    const baseEnv = env ?? process.env;
+    if (baseEnv.GIT_OPTIONAL_LOCKS !== undefined) return baseEnv;
+    return { ...baseEnv, GIT_OPTIONAL_LOCKS: "0" };
+  }
+
   async function runSandboxAttempt(
     command: string,
     wrappedCommand: string,
     cwd: string,
+    runtimeConfig: SandboxRuntimeConfig | null,
     onData: (data: Buffer) => void,
     existingViolationCount: number,
     signal?: AbortSignal,
@@ -1515,7 +2123,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     return new Promise((resolve, reject) => {
       const child = spawn("bash", ["-c", wrappedCommand], {
         cwd,
-        env,
+        env: withSandboxDefaultEnv(env),
         detached: true,
         stdio: ["ignore", "pipe", "pipe"],
       });
@@ -1524,6 +2132,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
       let timedOut = false;
       let interruptedByFilesystemViolation = false;
       let seenViolationCount = existingViolationCount;
+      const runtimeProtectedWriteViolations = new Map<string, FilesystemViolation>();
       let timeoutHandle: NodeJS.Timeout | undefined;
       let timeoutEscalationHandle: NodeJS.Timeout | undefined;
       let filesystemStopEscalationHandle: NodeJS.Timeout | undefined;
@@ -1538,11 +2147,9 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         }, 500);
       };
 
-      // sandbox-runtime only provides live filesystem violation events on macOS.
-      // Upstream documents Linux violation monitoring as future work via
-      // automatic strace-based detection integrated with the violation store,
-      // but there is no Linux implementation yet:
-      // https://github.com/anthropic-experimental/sandbox-runtime#known-limitations-and-future-work
+      // The Linux monitor filters attempts against configured write rules and does not
+      // report mandatory runtime denies within already-allowed paths, so runtime-protected
+      // continuation remains macOS-only.
       const unsubscribeViolations =
         process.platform !== "darwin"
           ? () => undefined
@@ -1554,14 +2161,23 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
               const newViolations = violations.slice(seenViolationCount);
               seenViolationCount = violations.length;
 
-              const runtimeConfig = getRuntimeConfig();
-              const shouldStop = newViolations.some((violation) => {
+              for (const violation of newViolations) {
                 const filesystemViolation = detectFilesystemViolationFromLine(violation.line);
-                if (!filesystemViolation) return false;
-                return !isMetadataTraversalViolation(runtimeConfig, filesystemViolation, cwd);
-              });
-              if (shouldStop) {
-                stopForFilesystemViolation();
+                if (filesystemViolation) {
+                  if (isTraversalViolation(runtimeConfig, filesystemViolation, cwd)) continue;
+
+                  if (isRuntimeProtectedWriteViolation(runtimeConfig, filesystemViolation, cwd)) {
+                    if (filesystemViolation.path) {
+                      runtimeProtectedWriteViolations.set(
+                        filesystemViolation.path,
+                        filesystemViolation,
+                      );
+                    }
+                    continue;
+                  }
+
+                  stopForFilesystemViolation();
+                }
               }
             });
 
@@ -1624,11 +2240,22 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
           exitCode: interruptedByFilesystemViolation && code === null ? 1 : code,
           combinedOutput: Buffer.concat(chunks).toString("utf-8"),
           interruptedByFilesystemViolation,
+          runtimeProtectedWriteViolations: Array.from(runtimeProtectedWriteViolations.values()),
         });
       });
     });
   }
 
+  function validateTimeout(timeout: number | undefined): void {
+    if (timeout === undefined) return;
+    if (!Number.isFinite(timeout) || timeout <= 0) {
+      throw new Error("Invalid timeout: must be a finite number of seconds");
+    }
+    if (timeout * 1000 > MAX_TIMEOUT_MS) {
+      throw new Error(`Invalid timeout: maximum is ${MAX_TIMEOUT_SECONDS} seconds`);
+    }
+  }
+
   function getRemainingTimeout(timeout: number | undefined, startedAt: number): number | undefined {
     if (timeout === undefined) return undefined;
 
@@ -1661,7 +2288,13 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
       applyRuntimeConfigForSession,
     });
 
-    const wrappedCommand = await SandboxManager.wrapWithSandbox(command);
+    const runtimeConfig = getRuntimeConfig();
+    const attemptRuntimeConfig = runtimeConfig ? cloneRuntimeConfig(runtimeConfig) : null;
+    const wrappedCommand = await SandboxManager.wrapWithSandbox(
+      command,
+      IS_MACOS ? MACOS_SANDBOX_SHELL : undefined,
+      attemptRuntimeConfig ?? undefined,
+    );
     const existingViolationCount =
       SandboxManager.getSandboxViolationStore().getViolationsForCommand(command).length;
 
@@ -1670,13 +2303,14 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         command,
         wrappedCommand,
         cwd,
+        attemptRuntimeConfig,
         onData,
         existingViolationCount,
         signal,
         timeout,
         env,
       );
-      return { attempt, existingViolationCount };
+      return { attempt, existingViolationCount, runtimeConfig: attemptRuntimeConfig };
     } catch (err) {
       safeCleanupAfterCommand();
       throw err;
@@ -1688,42 +2322,95 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     command: string;
     cwd: string;
     existingViolationCount: number;
+    runtimeConfig: SandboxRuntimeConfig | null;
     autoRetryAvailable: boolean;
   }): Promise<ProcessedSandboxAttempt> {
-    const { attempt, command, cwd, existingViolationCount, autoRetryAvailable } = options;
-    const commandSucceeded = attempt.exitCode === 0 && !attempt.interruptedByFilesystemViolation;
-    if (commandSucceeded) {
-      return { exitCode: attempt.exitCode, postamble: "", resolution: null };
-    }
-
+    const { attempt, command, cwd, existingViolationCount, runtimeConfig, autoRetryAvailable } =
+      options;
     const annotatedOutput = SandboxManager.annotateStderrWithSandboxFailures(
       command,
       attempt.combinedOutput,
     );
-    const runtimeConfig = getRuntimeConfig();
-    const metadataTraversalPaths = getMetadataTraversalPaths({
+    // Capture violations delivered after the child closed but before post-processing.
+    const storedViolationLines = SandboxManager.getSandboxViolationStore()
+      .getViolationsForCommand(command)
+      .slice(existingViolationCount)
+      .map((violation) => violation.line);
+    const storedFilesystemViolations = storedViolationLines
+      .map((line) => detectFilesystemViolationFromLine(line))
+      .filter((violation): violation is FilesystemViolation => violation !== null);
+    const runtimeProtectedWriteViolations = getRuntimeProtectedWriteViolations(
       runtimeConfig,
-      output: annotatedOutput,
+      [...attempt.runtimeProtectedWriteViolations, ...storedFilesystemViolations],
       cwd,
-      skipViolationLines: existingViolationCount,
-    });
-    const effectiveExitCode = metadataTraversalPaths ? 0 : attempt.exitCode;
+    );
+    const machLookupViolations = detectMachLookupViolations(storedViolationLines);
     let postamble = extractAppendedSandboxAnnotation(
       attempt.combinedOutput,
       annotatedOutput,
       existingViolationCount,
     );
-    let resolution: FilesystemViolationResolution | null = null;
 
-    if (metadataTraversalPaths) {
-      const notice = formatMetadataTraversalNotice(metadataTraversalPaths);
+    if (runtimeProtectedWriteViolations.length > 0) {
+      const notice = formatRuntimeProtectedWriteNotice(
+        runtimeProtectedWriteViolations,
+        !attempt.interruptedByFilesystemViolation,
+      );
       postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
-    } else if (runtimeConfig) {
+
+      for (const violation of runtimeProtectedWriteViolations) {
+        recordEvent?.({
+          timestamp: Date.now(),
+          kind: "filesystem",
+          outcome: "blocked",
+          reason: "runtime-protected-write",
+          target: violation.path,
+          command,
+          cwd,
+          summary: "filesystem write is protected by the sandbox runtime",
+        });
+      }
+    }
+
+    const commandSucceeded = attempt.exitCode === 0 && !attempt.interruptedByFilesystemViolation;
+    if (commandSucceeded) {
+      return {
+        exitCode: attempt.exitCode,
+        postamble,
+        resolution: null,
+        runtimeProtectedWriteViolations,
+      };
+    }
+
+    const traversalPaths = getTraversalPaths({
+      runtimeConfig,
+      output: annotatedOutput,
+      cwd,
+      skipViolationLines: existingViolationCount,
+    });
+    const continuedTraversal = machLookupViolations.length === 0 ? traversalPaths : null;
+    const effectiveExitCode = continuedTraversal ? 0 : attempt.exitCode;
+    let resolution: ViolationResolution | null = null;
+
+    if (continuedTraversal) {
+      const notice = formatTraversalNotice(continuedTraversal);
+      postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
+    } else {
+      const currentRuntimeConfig = getRuntimeConfig();
+      if (!currentRuntimeConfig) {
+        return {
+          exitCode: effectiveExitCode,
+          postamble,
+          resolution,
+          runtimeProtectedWriteViolations,
+        };
+      }
+
       resolution = await handleFilesystemViolation({
         pi,
         ctx: getContext(),
         promptMode: getPromptMode(),
-        runtimeConfig,
+        runtimeConfig: currentRuntimeConfig,
         output: annotatedOutput,
         rawOutput: attempt.combinedOutput,
         command,
@@ -1733,18 +2420,42 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         existingViolationCount,
         recordEvent,
         autoRetryAvailable,
+        runtimeProtectedWriteViolations,
+        allowOutputFallback: machLookupViolations.length === 0,
       });
 
+      if (!resolution) {
+        resolution = await handleMachLookupViolation({
+          pi,
+          ctx: getContext(),
+          promptMode: getPromptMode(),
+          runtimeConfig: currentRuntimeConfig,
+          violations: machLookupViolations,
+          command,
+          cwd,
+          pendingPrompts: pendingMachLookupPrompts,
+          applyRuntimeConfigForSession,
+          recordEvent,
+          autoRetryAvailable,
+        });
+      }
+
       if (resolution) {
         postamble = appendOutputPostamble(postamble, resolution.message, attempt.combinedOutput);
       }
     }
 
-    return { exitCode: effectiveExitCode, postamble, resolution };
+    return {
+      exitCode: effectiveExitCode,
+      postamble,
+      resolution,
+      runtimeProtectedWriteViolations,
+    };
   }
 
   return {
     async exec(command, cwd, { onData, signal, timeout, env }) {
+      validateTimeout(timeout);
       return runSerially(async () => {
         if (!existsSync(cwd)) {
           throw new Error(`Working directory does not exist: ${cwd}`);
@@ -1767,6 +2478,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             command,
             cwd,
             existingViolationCount: initialRun.existingViolationCount,
+            runtimeConfig: initialRun.runtimeConfig,
             autoRetryAvailable: true,
           });
         } catch (postProcessError) {
@@ -1811,6 +2523,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             command,
             cwd,
             existingViolationCount: retryRun.existingViolationCount,
+            runtimeConfig: retryRun.runtimeConfig,
             autoRetryAvailable: false,
           });
         } catch (postProcessError) {
@@ -1826,7 +2539,10 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             retryResolution.retrySuccessMessage,
             retryRun.attempt.combinedOutput,
           );
-        } else if (!processedRetry.resolution) {
+        } else if (
+          !processedRetry.resolution &&
+          processedRetry.runtimeProtectedWriteViolations.length === 0
+        ) {
           retryPostamble = appendOutputPostamble(
             retryPostamble,
             retryResolution.retryFailureMessage,
@@ -1849,7 +2565,7 @@ function getSandboxRunMode(state: SandboxState): SandboxRunMode {
 }
 
 function getStateRuntimeConfig(state: SandboxState): SandboxRuntimeConfig | null {
-  if (state.status === "active" || state.status === "suspended") return state.runtimeConfig;
+  if (state.status === "active") return state.runtimeConfig;
   return null;
 }
 
@@ -1917,6 +2633,9 @@ function describeFilesystemEventSummary(
 
   if (reason === "explicit-deny-read") return "filesystem read matched a deny-read rule";
   if (reason === "explicit-deny-write") return "filesystem write matched a deny-write rule";
+  if (reason === "runtime-protected-write") {
+    return "filesystem write is protected by the sandbox runtime";
+  }
   if (reason === "already-approved-still-failed") {
     return "filesystem access was previously allowed for this session but is still failing";
   }
@@ -1985,7 +2704,12 @@ function renderSandboxDoctorReport(options: {
   } else {
     lines.push("- Config paths:");
     for (const configPath of configPaths) {
-      const status = configPath.status === "loaded" ? "loaded" : "parse error";
+      const status =
+        configPath.status === "loaded"
+          ? "loaded"
+          : configPath.status === "skipped-untrusted"
+            ? "skipped (project not trusted)"
+            : "parse error";
       lines.push(`  - ${configPath.label}: ${configPath.path} (${status})`);
     }
   }
@@ -2017,6 +2741,10 @@ function getSandboxConfigParseErrors(paths: SandboxConfigPath[]): SandboxConfigP
   return paths.filter((configPath) => configPath.status === "parse-error");
 }
 
+function getSkippedUntrustedProjectConfigPaths(paths: SandboxConfigPath[]): SandboxConfigPath[] {
+  return paths.filter((configPath) => configPath.status === "skipped-untrusted");
+}
+
 function notifySandboxConfigParseErrors(ctx: ExtensionContext, paths: SandboxConfigPath[]): void {
   const details = paths
     .map((configPath) => `${configPath.label.toLowerCase()} (${configPath.path})`)
@@ -2042,7 +2770,7 @@ function loadSandboxConfigForContext(
   const { exitOnError = false } = options;
 
   try {
-    return loadConfig(cwd, overrideConfigPath);
+    return loadConfig(cwd, overrideConfigPath, { projectTrusted: ctx.isProjectTrusted() });
   } catch (error) {
     if (!(error instanceof SandboxConfigLoadError)) throw error;
 
@@ -2083,6 +2811,7 @@ export default function (pi: ExtensionAPI) {
   let sessionContext: ExtensionContext | null = null;
   let sandboxConfigPaths: SandboxConfigPath[] = [];
   let sandboxEvents: SandboxEvent[] = [];
+  const warnedSkippedProjectConfigPaths = new Set<string>();
 
   const pendingNetworkApprovals = new Map<string, Promise<boolean>>();
 
@@ -2127,21 +2856,38 @@ export default function (pi: ExtensionAPI) {
     });
   }
 
+  function notifySkippedUntrustedProjectConfigs(ctx: ExtensionContext): void {
+    const skippedConfigs = getSkippedUntrustedProjectConfigPaths(sandboxConfigPaths).filter(
+      (configPath) => !warnedSkippedProjectConfigPaths.has(configPath.path),
+    );
+    if (skippedConfigs.length === 0) return;
+
+    for (const configPath of skippedConfigs) {
+      warnedSkippedProjectConfigPaths.add(configPath.path);
+    }
+
+    const details = skippedConfigs.map((configPath) => configPath.path).join(", ");
+    notify(
+      ctx,
+      `Ignoring project sandbox config because this project is not trusted: ${details}`,
+      "warning",
+    );
+  }
+
   function applyRuntimeConfigForSession(
     ctx: ExtensionContext,
     runtimeConfig: SandboxRuntimeConfig,
-    targetStatus: "active" | "suspended" = sandboxState.status === "suspended"
-      ? "suspended"
-      : "active",
   ): void {
     const nextConfig = cloneRuntimeConfig(runtimeConfig);
-    sandboxState = { status: targetStatus, runtimeConfig: nextConfig };
+    sandboxState = { status: "active", runtimeConfig: nextConfig };
     SandboxManager.updateConfig(nextConfig);
-    setSandboxStatus(ctx, targetStatus === "active", nextConfig, promptMode);
+    setSandboxStatus(ctx, true, nextConfig, promptMode);
   }
 
   const createNetworkAskCallback = (): SandboxAskCallback => {
     return async ({ host, port }) => {
+      if (sandboxState.status === "suspended") return true;
+
       const normalizedHost = host.toLowerCase();
       const key = normalizedHost;
 
@@ -2355,6 +3101,7 @@ export default function (pi: ExtensionAPI) {
     if (!loadedConfig) return;
 
     sandboxConfigPaths = loadedConfig.paths;
+    notifySkippedUntrustedProjectConfigs(ctx);
     const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
     if (parseErrors.length > 0) {
       notifySandboxConfigParseErrors(ctx, parseErrors);
@@ -2444,47 +3191,34 @@ export default function (pi: ExtensionAPI) {
           return;
         }
 
-        let runtimeConfig: SandboxRuntimeConfig | null = null;
-        let initializedNow = false;
-
-        if (sandboxState.status === "suspended") {
-          runtimeConfig = sandboxState.runtimeConfig;
-        } else {
-          if (!isSupportedPlatform()) {
-            sandboxState = { status: "blocked", reason: "unsupported-platform" };
-            recordRuntimeEvent(
-              "init",
-              "unsupported-platform",
-              `sandbox not supported on ${process.platform}`,
-            );
-            notify(ctx, `Sandbox not supported on ${process.platform}`, "warning");
-            return;
-          }
+        if (!isSupportedPlatform()) {
+          sandboxState = { status: "blocked", reason: "unsupported-platform" };
+          recordRuntimeEvent(
+            "init",
+            "unsupported-platform",
+            `sandbox not supported on ${process.platform}`,
+          );
+          notify(ctx, `Sandbox not supported on ${process.platform}`, "warning");
+          return;
+        }
 
-          const sandboxConfigOverride = getStringFlag(pi, "sandbox-config");
-          const loadedConfig = loadSandboxConfigForContext(ctx, ctx.cwd, sandboxConfigOverride);
-          if (!loadedConfig) return;
+        const sandboxConfigOverride = getStringFlag(pi, "sandbox-config");
+        const loadedConfig = loadSandboxConfigForContext(ctx, ctx.cwd, sandboxConfigOverride);
+        if (!loadedConfig) return;
 
-          sandboxConfigPaths = loadedConfig.paths;
-          const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
-          if (parseErrors.length > 0) {
-            notifySandboxConfigParseErrors(ctx, parseErrors);
-          }
-          sandboxConfig = loadedConfig.config;
-          runtimeConfig = await initializeSandboxRuntime(ctx, loadedConfig.config);
-          if (!runtimeConfig) return;
-          initializedNow = true;
+        sandboxConfigPaths = loadedConfig.paths;
+        notifySkippedUntrustedProjectConfigs(ctx);
+        const parseErrors = getSandboxConfigParseErrors(sandboxConfigPaths);
+        if (parseErrors.length > 0) {
+          notifySandboxConfigParseErrors(ctx, parseErrors);
         }
-
+        sandboxConfig = loadedConfig.config;
+        const runtimeConfig = await initializeSandboxRuntime(ctx, loadedConfig.config);
         if (!runtimeConfig) return;
 
-        if (initializedNow) {
-          setSandboxStatus(ctx, true, runtimeConfig, promptMode);
-        } else {
-          applyRuntimeConfigForSession(ctx, runtimeConfig, "active");
-        }
+        setSandboxStatus(ctx, true, runtimeConfig, promptMode);
 
-        notify(ctx, "Sandbox enabled", "info");
+        announceSandboxState(pi, ctx, true);
         return;
       }
 
@@ -2499,9 +3233,22 @@ export default function (pi: ExtensionAPI) {
           return;
         }
 
-        sandboxState = { status: "suspended", runtimeConfig: sandboxState.runtimeConfig };
+        sandboxState = { status: "suspended" };
+        pendingNetworkApprovals.clear();
         setSandboxStatus(ctx, false);
-        notify(ctx, "Sandbox disabled", "info");
+
+        try {
+          await SandboxManager.reset();
+        } catch (error) {
+          notify(
+            ctx,
+            `Sandbox disabled, but cleanup failed: ${error instanceof Error ? error.message : error}`,
+            "warning",
+          );
+          return;
+        }
+
+        announceSandboxState(pi, ctx, false);
         return;
       }
 
@@ -2529,9 +3276,17 @@ export default function (pi: ExtensionAPI) {
           `    allowLocalBinding: ${runtimeConfig.network.allowLocalBinding ? "true" : "false"}`,
           `    allowAllUnixSockets: ${runtimeConfig.network.allowAllUnixSockets ? "true" : "false"}`,
           `    allowUnixSockets: ${runtimeConfig.network.allowUnixSockets?.join(", ") || "(none)"}`,
+          ...(IS_MACOS
+            ? [
+                "",
+                "  macOS service lookup (mach-lookup):",
+                `    Allowed: ${runtimeConfig.network.allowMachLookup?.join(", ") || "(none)"}`,
+              ]
+            : []),
           "",
           "  Filesystem:",
           `    Deny Read: ${runtimeConfig.filesystem.denyRead.join(", ") || "(none)"}`,
+          `    Allow Read: ${runtimeConfig.filesystem.allowRead?.join(", ") || "(none)"}`,
           `    Allow Write: ${runtimeConfig.filesystem.allowWrite.join(", ") || "(none)"}`,
           `    Deny Write: ${runtimeConfig.filesystem.denyWrite.join(", ") || "(none)"}`,
           `    allowTempDirs: ${sandboxConfig?.filesystem.allowTempDirs ? "true" : "false"}`,
@@ -2606,6 +3361,42 @@ export default function (pi: ExtensionAPI) {
         return;
       }
 
+      if (subcommand === "mach-lookup") {
+        if (!IS_MACOS) {
+          notify(ctx, "Mach service lookup controls are only available on macOS.", "warning");
+          return;
+        }
+
+        const runtimeConfig = requireRuntimeConfig(ctx, sandboxState);
+        if (!runtimeConfig) return;
+
+        const op = tokens[1]?.toLowerCase() as ListOp | undefined;
+        const service = tokens[2]?.trim() ?? "";
+
+        if (
+          (op !== "add" && op !== "remove") ||
+          tokens.length !== 3 ||
+          !isValidMachLookupRule(service)
+        ) {
+          notify(ctx, "Usage: /sandbox mach-lookup <add|remove> <service>", "warning");
+          return;
+        }
+
+        const nextConfig = cloneRuntimeConfig(runtimeConfig);
+        const changed = mutateMachLookupAllowList(nextConfig, op, service);
+        if (!changed) {
+          notify(
+            ctx,
+            `No change: mach-lookup allow list already ${op === "add" ? "contains" : "omits"} ${service}`,
+          );
+          return;
+        }
+
+        applyRuntimeConfigForSession(ctx, nextConfig);
+        notify(ctx, `Updated mach-lookup allow list (${op}: ${service})`, "info");
+        return;
+      }
+
       if (subcommand === "filesystem") {
         const runtimeConfig = requireRuntimeConfig(ctx, sandboxState);
         if (!runtimeConfig) return;