tau-coding-agent 0.1.5 → 0.1.6

package/extensions/sandbox/index.ts

@@ -21,7 +21,12 @@
  *   "mode": "interactive",
  *   "network": {
  *     "allowedDomains": ["github.com", "*.github.com"],
- *     "deniedDomains": []
+ *     "deniedDomains": [],
+ *     "allowMachLookup": [
+ *       "com.apple.dnssd.service",
+ *       "com.apple.SystemConfiguration.configd",
+ *       "com.apple.SystemConfiguration.DNSConfiguration"
+ *     ]
  *   },
  *   "filesystem": {
  *     "denyRead": ["~/.ssh", "~/.aws"],
@@ -50,6 +55,7 @@ import { spawn, spawnSync } from "node:child_process";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir, tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import {
   SandboxManager,
   type SandboxAskCallback,
@@ -75,6 +81,8 @@ import {
 // --- Constants ---
 
 const DEFAULT_PROMPT_MODE: PromptMode = "interactive";
+const IS_MACOS = process.platform === "darwin";
+const MACOS_SANDBOX_SHELL = fileURLToPath(new URL("./macos-sandbox-shell.mjs", import.meta.url));
 const MAX_TIMEOUT_MS = 2_147_483_647;
 const MAX_TIMEOUT_SECONDS = MAX_TIMEOUT_MS / 1000;
 
@@ -154,6 +162,11 @@ const DEFAULT_CONFIG: SandboxConfig = {
     deniedDomains: [],
     allowUnixSockets: ["$SSH_AUTH_SOCK"],
     allowLocalBinding: true,
+    allowMachLookup: [
+      "com.apple.dnssd.service",
+      "com.apple.SystemConfiguration.configd",
+      "com.apple.SystemConfiguration.DNSConfiguration",
+    ],
   },
   filesystem: {
     denyRead: ["~/.ssh", "~/.aws", "~/.gnupg"],
@@ -201,7 +214,7 @@ const DEFAULT_CONFIG: SandboxConfig = {
     allowGitCommonDir: true,
   },
   ignoreViolations: {
-    "*": ["/__pycache__"],
+    "*": ["/__pycache__", "mach-lookup com.apple.usymptomsd"],
   },
 };
 
@@ -214,6 +227,20 @@ const ENV_PATH_REFERENCE_PATTERN = /\$(?:\{([A-Za-z_][A-Za-z0-9_]*)\}|([A-Za-z_]
 // --- Types ---
 
 type PromptMode = "interactive" | "non-interactive";
+type ListOp = "add" | "remove";
+type SandboxEventOutcome = "blocked" | "allowed";
+type ViolationResolutionKind = "allow-retry" | "allow-adapt" | "deny";
+
+type ViolationResolution =
+  | {
+      kind: "allow-retry";
+      message: string;
+      retrySuccessMessage: string;
+      retryFailureMessage: string;
+      retrySkippedMessage: string;
+    }
+  | { kind: "allow-adapt"; message: string }
+  | { kind: "deny"; message: string };
 
 type SandboxBypassReason = "no-sandbox-flag" | "config-disabled" | "missing-dependencies";
 type SandboxBlockedReason = "unsupported-platform" | "init-failed";
@@ -236,34 +263,32 @@ type SandboxConfig = Omit<SandboxRuntimeConfig, "filesystem"> & {
   };
 };
 
-type SandboxEventKind = "filesystem" | "network" | "init" | "runtime";
+type SandboxEventKind = "filesystem" | "network" | "mach-lookup" | "init" | "runtime";
 type SandboxEventReason =
   | "explicit-deny-read"
   | "explicit-deny-write"
   | "explicit-deny-domain"
   | "missing-allow-write"
   | "missing-allowed-domain"
+  | "missing-mach-lookup"
   | "missing-dependencies"
   | "unsupported-platform"
   | "init-failed"
+  | "runtime-protected-write"
   | "already-approved-still-failed"
   | "unknown";
-type SandboxEventOutcome = "blocked" | "allowed";
 type SandboxConfigPathStatus = "loaded" | "parse-error" | "skipped-untrusted";
 type SandboxConfigPathLabel = "Global" | "Project" | "Override";
 
 type PromptStatus = "completed" | "error";
 type UiLevel = "info" | "warning" | "error";
 
-type ListOp = "add" | "remove";
 type NetworkList = "allow" | "deny";
 type FilesystemList = "deny-read" | "allow-write" | "deny-write";
 
 type FilesystemViolationKind = "read" | "write" | "unknown";
 type FilesystemReadAccess = "metadata" | "data" | "unknown";
 type FilesystemWriteAccess = "unlink" | "unknown";
-type FilesystemViolationResolutionKind = "allow-retry" | "allow-adapt" | "deny";
-
 interface SandboxEvent {
   timestamp: number;
   kind: SandboxEventKind;
@@ -314,16 +339,9 @@ interface FilesystemViolation {
   writeAccess?: FilesystemWriteAccess;
 }
 
-type FilesystemViolationResolution =
-  | {
-      kind: "allow-retry";
-      message: string;
-      retrySuccessMessage: string;
-      retryFailureMessage: string;
-      retrySkippedMessage: string;
-    }
-  | { kind: "allow-adapt"; message: string }
-  | { kind: "deny"; message: string };
+interface MachLookupViolation {
+  service: string;
+}
 
 // --- Helpers ---
 
@@ -374,6 +392,19 @@ function notify(ctx: ExtensionContext, text: string, level: UiLevel = "info"): v
   else console.log(text);
 }
 
+function announceSandboxState(pi: ExtensionAPI, ctx: ExtensionContext, enabled: boolean): void {
+  const text = `Sandbox ${enabled ? "enabled" : "disabled"}`;
+  notify(ctx, text, "info");
+  pi.sendMessage(
+    {
+      customType: "sandbox-state",
+      content: text,
+      display: false,
+    },
+    { triggerTurn: false },
+  );
+}
+
 function showHelp(ctx: ExtensionContext): void {
   const lines = [
     "Usage:",
@@ -383,6 +414,12 @@ function showHelp(ctx: ExtensionContext): void {
     "  /sandbox doctor",
     "  /sandbox mode <interactive|non-interactive>",
     "  /sandbox network <allow|deny> <add|remove> <domain>",
+    ...(IS_MACOS
+      ? [
+          "  /sandbox mach-lookup <add|remove> <service>",
+          "    Service rules support one trailing *; use * for all services.",
+        ]
+      : []),
     "  /sandbox filesystem <deny-read|allow-write|deny-write> <add|remove> <path>",
     "",
     "Startup flags:",
@@ -438,6 +475,7 @@ const SANDBOX_TOP_LEVEL_COMPLETIONS: CommandCompletionOption[] = [
   { value: "doctor", label: "doctor" },
   { value: "mode ", label: "mode" },
   { value: "network ", label: "network" },
+  ...(IS_MACOS ? [{ value: "mach-lookup ", label: "mach-lookup" }] : []),
   { value: "filesystem ", label: "filesystem" },
   { value: "help", label: "help" },
 ];
@@ -503,6 +541,37 @@ function getStringValueCompletions(
   }));
 }
 
+function getMachLookupArgumentCompletions(options: {
+  tokens: string[];
+  endsWithSpace: boolean;
+  runtimeConfig: SandboxRuntimeConfig | null;
+}): Array<{ value: string; label: string; description?: string }> | null {
+  const { tokens, endsWithSpace, runtimeConfig } = options;
+
+  if (tokens.length === 1 && endsWithSpace) {
+    return getCommandCompletions("mach-lookup ", "", SANDBOX_LIST_OPERATION_COMPLETIONS);
+  }
+  if (tokens.length === 2 && !endsWithSpace) {
+    return getCommandCompletions(
+      "mach-lookup ",
+      tokens[1] ?? "",
+      SANDBOX_LIST_OPERATION_COMPLETIONS,
+    );
+  }
+
+  if (tokens[1]?.toLowerCase() !== "remove") return null;
+
+  const values = runtimeConfig?.network.allowMachLookup ?? [];
+  const valueBase = "mach-lookup remove ";
+  if (tokens.length === 2 && endsWithSpace) {
+    return getStringValueCompletions(valueBase, "", values);
+  }
+  if (tokens.length === 3 && !endsWithSpace) {
+    return getStringValueCompletions(valueBase, tokens[2] ?? "", values);
+  }
+  return null;
+}
+
 function getSandboxArgumentCompletions(
   prefix: string,
   runtimeConfig: SandboxRuntimeConfig | null,
@@ -566,6 +635,10 @@ function getSandboxArgumentCompletions(
     return null;
   }
 
+  if (subcommand === "mach-lookup" && IS_MACOS) {
+    return getMachLookupArgumentCompletions({ tokens, endsWithSpace, runtimeConfig });
+  }
+
   if (subcommand === "filesystem") {
     if (tokens.length === 1 && endsWithSpace) {
       return getCommandCompletions("filesystem ", "", SANDBOX_FILESYSTEM_LIST_COMPLETIONS);
@@ -697,6 +770,11 @@ function finalizeConfig(config: SandboxConfig): SandboxConfig {
         DEFAULT_CONFIG.network.deniedDomains,
         "network.deniedDomains",
       ),
+      allowMachLookup: coerceStringArray(
+        config.network?.allowMachLookup,
+        DEFAULT_CONFIG.network.allowMachLookup ?? [],
+        "network.allowMachLookup",
+      ),
       allowUnixSockets: coerceOptionalStringArray(
         config.network?.allowUnixSockets,
         DEFAULT_CONFIG.network.allowUnixSockets,
@@ -1057,6 +1135,42 @@ function isSandboxWritablePath(
   return inferSandboxRuleMatch(path, runtimeConfig.filesystem.denyWrite, cwd) === null;
 }
 
+function isRuntimeProtectedWriteViolation(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  violation: FilesystemViolation,
+  cwd?: string,
+): boolean {
+  if (
+    !runtimeConfig ||
+    runtimeConfig.filesystem.disabled ||
+    !violation.path ||
+    violation.kind !== "write"
+  ) {
+    return false;
+  }
+
+  return isSandboxWritablePath(runtimeConfig, violation.path, cwd);
+}
+
+function getRuntimeProtectedWriteViolations(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  violations: FilesystemViolation[],
+  cwd?: string,
+): FilesystemViolation[] {
+  const violationsByPath = new Map<string, FilesystemViolation>();
+
+  for (const violation of violations) {
+    if (!isRuntimeProtectedWriteViolation(runtimeConfig, violation, cwd) || !violation.path) {
+      continue;
+    }
+    if (!violationsByPath.has(violation.path)) {
+      violationsByPath.set(violation.path, violation);
+    }
+  }
+
+  return Array.from(violationsByPath.values());
+}
+
 function resolveGitFilesystemPaths(cwd: string): GitFilesystemPaths | null {
   if (GIT_FILESYSTEM_PATHS_CACHE.has(cwd)) {
     return GIT_FILESYSTEM_PATHS_CACHE.get(cwd) ?? null;
@@ -1140,8 +1254,8 @@ function extractAppendedSandboxAnnotation(
       : violationLines;
   if (newViolationLines.length === 0) return "";
 
-  // Filesystem and network sandbox violations are summarized elsewhere via compact
-  // extension messages, so suppress the verbose synthetic annotation block.
+  // Sandbox violations are summarized elsewhere via compact extension messages,
+  // so suppress the verbose synthetic annotation block.
   return "";
 }
 
@@ -1192,6 +1306,57 @@ function extractViolationProcessName(line: string): string | undefined {
   return processName.split("/").pop() || processName;
 }
 
+function detectMachLookupViolationFromLine(line: string): MachLookupViolation | null {
+  const match = line.match(/\bdeny\(\d+\)\s+mach-lookup\s+([^\s()"'*]+)/i);
+  const service = match?.[1];
+  return service ? { service } : null;
+}
+
+function detectMachLookupViolations(lines: string[]): MachLookupViolation[] {
+  const violationsByService = new Map<string, MachLookupViolation>();
+
+  for (let index = lines.length - 1; index >= 0; index -= 1) {
+    const violation = detectMachLookupViolationFromLine(lines[index]);
+    if (violation && !violationsByService.has(violation.service)) {
+      violationsByService.set(violation.service, violation);
+    }
+  }
+
+  return Array.from(violationsByService.values());
+}
+
+function isValidMachLookupRule(rule: string): boolean {
+  const trimmed = rule.trim();
+  if (!trimmed || /\s/.test(trimmed)) return false;
+
+  const prefix = trimmed.endsWith("*") ? trimmed.slice(0, -1) : trimmed;
+  return !prefix.includes("*");
+}
+
+function matchesMachLookupRule(service: string, rule: string): boolean {
+  if (rule === "*") return true;
+  if (rule.endsWith("*")) return service.startsWith(rule.slice(0, -1));
+  return service === rule;
+}
+
+function mutateMachLookupAllowList(
+  runtimeConfig: SandboxRuntimeConfig,
+  op: ListOp,
+  service: string,
+): boolean {
+  runtimeConfig.network.allowMachLookup ??= [];
+  return mutateStringList(runtimeConfig.network.allowMachLookup, op, service);
+}
+
+function isMachLookupAlreadyAllowed(
+  runtimeConfig: SandboxRuntimeConfig | null,
+  service: string,
+): boolean {
+  return (runtimeConfig?.network.allowMachLookup ?? []).some((rule) =>
+    matchesMachLookupRule(service, rule),
+  );
+}
+
 function detectFilesystemViolationFromLine(line: string): FilesystemViolation | null {
   // Runtime emits concrete op variants (e.g. file-write-create/unlink, file-read-data).
   const lower = line.toLowerCase();
@@ -1225,6 +1390,7 @@ function detectFilesystemViolations(
   output: string,
   fallbackOutput: string = output,
   skipViolationLines = 0,
+  allowOutputFallback = true,
 ): FilesystemViolation[] {
   const violations: FilesystemViolation[] = [];
   const allViolationLines = extractSandboxViolationLines(output);
@@ -1238,7 +1404,7 @@ function detectFilesystemViolations(
     if (violation) violations.push(violation);
   }
 
-  if (violations.length > 0) return violations;
+  if (violations.length > 0 || !allowOutputFallback) return violations;
 
   const hasEperm = /\bEPERM\b/i.test(fallbackOutput);
   const hasOperationNotPermitted = /(?:^|\n)[^\n]*Operation not permitted(?:$|\n)/i.test(
@@ -1314,6 +1480,22 @@ function formatTraversalNotice(paths: string[]): string {
   return `[sandbox] Continued after skipping protected ${label}: ${visiblePaths}${suffix}`;
 }
 
+function formatRuntimeProtectedWriteNotice(
+  violations: FilesystemViolation[],
+  continued: boolean,
+): string {
+  const paths = violations
+    .map((violation) => violation.path)
+    .filter((path): path is string => path !== undefined);
+  if (paths.length === 0) return "";
+
+  const visiblePaths = paths.slice(0, 3).join(", ");
+  const suffix = paths.length > 3 ? ", ..." : "";
+  const label = paths.length === 1 ? "write" : "writes";
+  const prefix = continued ? "Continued after blocking" : "Blocked";
+  return `[sandbox] ${prefix} runtime-protected ${label} that sandbox config cannot override: ${visiblePaths}${suffix}`;
+}
+
 function escapeSlashCommandArg(value: string): string {
   if (/^[a-zA-Z0-9_./:@%+\-~]+$/.test(value)) return value;
   return JSON.stringify(value);
@@ -1434,62 +1616,63 @@ function formatFilesystemViolationSummary(violation: FilesystemViolation): strin
   return "[sandbox] Blocked filesystem access (EPERM).";
 }
 
-const FILESYSTEM_ALLOW_RETRY_OPTION = "Allow and retry now";
-const FILESYSTEM_ALLOW_ADAPT_OPTION = "Allow but adapt for side-effects";
-const FILESYSTEM_DENY_OPTION = "Deny";
+const VIOLATION_ALLOW_RETRY_OPTION = "Allow and retry now";
+const VIOLATION_ALLOW_ADAPT_OPTION = "Allow but adapt for side-effects";
+const VIOLATION_DENY_OPTION = "Deny";
 
-function getFilesystemPromptOptions(
-  _violation: FilesystemViolation,
-  autoRetryAvailable: boolean,
-): string[] {
+function getViolationPromptOptions(autoRetryAvailable: boolean): string[] {
   if (!autoRetryAvailable) {
-    return [FILESYSTEM_ALLOW_ADAPT_OPTION, FILESYSTEM_DENY_OPTION];
+    return [VIOLATION_ALLOW_ADAPT_OPTION, VIOLATION_DENY_OPTION];
   }
 
-  return [FILESYSTEM_ALLOW_RETRY_OPTION, FILESYSTEM_ALLOW_ADAPT_OPTION, FILESYSTEM_DENY_OPTION];
+  return [VIOLATION_ALLOW_RETRY_OPTION, VIOLATION_ALLOW_ADAPT_OPTION, VIOLATION_DENY_OPTION];
 }
 
-function parseFilesystemPromptSelection(
+function parseViolationPromptSelection(
   selection: string | undefined,
   autoRetryAvailable: boolean,
-): FilesystemViolationResolutionKind {
-  if (selection === FILESYSTEM_ALLOW_ADAPT_OPTION) return "allow-adapt";
-  if (selection === FILESYSTEM_ALLOW_RETRY_OPTION && autoRetryAvailable) return "allow-retry";
+): ViolationResolutionKind {
+  if (selection === VIOLATION_ALLOW_ADAPT_OPTION) return "allow-adapt";
+  if (selection === VIOLATION_ALLOW_RETRY_OPTION && autoRetryAvailable) return "allow-retry";
   return "deny";
 }
 
-function formatFilesystemAllowRetryMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nGranting access and retrying the command per user request...\n\n`;
+function formatViolationAllowRetryMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nGranting access and retrying the command per user request...\n\n`;
 }
 
-function formatFilesystemAllowAdaptMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session. Retry the command manually if appropriate.`;
+function formatViolationAllowAdaptMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session. Retry the command manually if appropriate.`;
 }
 
-function formatFilesystemDeniedMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess remains denied for this session.`;
+function formatViolationDeniedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess remains denied for this session.`;
 }
 
-function formatFilesystemAlreadyAllowedMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess had already been granted for this session. The remaining failure may be unrelated to sandbox policy.`;
+function formatViolationAlreadyAllowedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess had already been granted for this session. The remaining failure may be unrelated to sandbox policy.`;
 }
 
-function formatFilesystemRetrySucceededMessage(_target: string): string {
-  return "";
+function formatViolationRetrySucceededMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session and the command was retried successfully.`;
 }
 
-function formatFilesystemRetryFailedMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session and the command was retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.`;
+function formatViolationRetryFailedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session and the command was retried per user request, but the command still exited non-zero. The sandbox block was resolved; the remaining failure may be unrelated.`;
 }
 
-function formatFilesystemRetrySkippedMessage(target: string): string {
-  return `\n${formatFilesystemBlockedTarget(target)}\n\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.`;
+function formatViolationRetrySkippedMessage(blockedTarget: string): string {
+  return `\n${blockedTarget}\n\nAccess granted for this session, but automatic retry was skipped because the timeout was exhausted. Retry the command manually if needed.`;
 }
 
 function formatFilesystemBlockedTarget(target: string): string {
   return `Sandbox blocked filesystem ${target}.`;
 }
 
+function formatMachLookupBlockedTarget(service: string): string {
+  return `Sandbox blocked access to macOS service ${service}.`;
+}
+
 function appendOutputPostamble(postamble: string, addition: string, output: string): string {
   if (!addition) return postamble;
 
@@ -1513,7 +1696,7 @@ async function handleFilesystemViolation(options: {
   rawOutput: string;
   command: string;
   cwd?: string;
-  pendingPrompts?: Map<string, Promise<FilesystemViolationResolution | null>>;
+  pendingPrompts?: Map<string, Promise<ViolationResolution | null>>;
   applyRuntimeConfigForSession?: (
     ctx: ExtensionContext,
     runtimeConfig: SandboxRuntimeConfig,
@@ -1521,7 +1704,9 @@ async function handleFilesystemViolation(options: {
   existingViolationCount?: number;
   recordEvent?: (event: SandboxEvent) => void;
   autoRetryAvailable?: boolean;
-}): Promise<FilesystemViolationResolution | null> {
+  runtimeProtectedWriteViolations?: FilesystemViolation[];
+  allowOutputFallback?: boolean;
+}): Promise<ViolationResolution | null> {
   const {
     pi,
     ctx,
@@ -1536,19 +1721,35 @@ async function handleFilesystemViolation(options: {
     existingViolationCount,
     recordEvent,
     autoRetryAvailable = true,
+    runtimeProtectedWriteViolations = [],
+    allowOutputFallback = true,
   } = options;
-  const violations = detectFilesystemViolations(output, rawOutput, existingViolationCount ?? 0);
-  if (violations.length === 0) return null;
+  const violations = detectFilesystemViolations(
+    output,
+    rawOutput,
+    existingViolationCount ?? 0,
+    allowOutputFallback,
+  );
+  const runtimeProtectedWritePaths = new Set(
+    runtimeProtectedWriteViolations.map((violation) => violation.path).filter(Boolean),
+  );
+  const actionableViolations = violations.filter((violation) => {
+    const isRuntimeProtectedWrite =
+      violation.kind !== "read" && runtimeProtectedWritePaths.has(violation.path);
+    return !isRuntimeProtectedWrite && !isTraversalViolation(runtimeConfig, violation, cwd);
+  });
+  if (actionableViolations.length === 0) return null;
 
   const violation =
-    violations.find((candidate) => {
+    actionableViolations.find((candidate) => {
       const candidateAction = buildFilesystemAllowAction(runtimeConfig, candidate, cwd);
       if (!candidateAction) return false;
       return !isFilesystemAllowActionAlreadyApplied(runtimeConfig, candidateAction);
-    }) ?? violations[0];
+    }) ?? actionableViolations[0];
 
   const summary = formatFilesystemViolationSummary(violation);
   const target = describeFilesystemViolationTarget(violation);
+  const blockedTarget = formatFilesystemBlockedTarget(target);
   const allowAction = buildFilesystemAllowAction(runtimeConfig, violation, cwd);
   const allowCommand = allowAction ? buildFilesystemAllowCommand(allowAction) : null;
   const alreadyApproved = allowAction
@@ -1587,25 +1788,25 @@ async function handleFilesystemViolation(options: {
 
   if (alreadyApproved) {
     recordFilesystemEvent("blocked");
-    return { kind: "allow-adapt", message: formatFilesystemAlreadyAllowedMessage(target) };
+    return { kind: "allow-adapt", message: formatViolationAlreadyAllowedMessage(blockedTarget) };
   }
 
   const promptKey = `${allowCommand}:${autoRetryAvailable ? "retry" : "adapt"}`;
   const existingPrompt = pendingPrompts?.get(promptKey);
   if (existingPrompt) return existingPrompt;
 
-  const promptTask: Promise<FilesystemViolationResolution | null> = (async () => {
+  const promptTask: Promise<ViolationResolution | null> = (async () => {
     try {
       const selection = await withPromptSignal(pi, () =>
         ctx.ui.select(
           `Sandbox blocked filesystem ${target}`,
-          getFilesystemPromptOptions(violation, autoRetryAvailable),
+          getViolationPromptOptions(autoRetryAvailable),
         ),
       );
-      const decision = parseFilesystemPromptSelection(selection, autoRetryAvailable);
+      const decision = parseViolationPromptSelection(selection, autoRetryAvailable);
       if (decision === "deny") {
         recordFilesystemEvent("blocked");
-        return { kind: "deny", message: formatFilesystemDeniedMessage(target) };
+        return { kind: "deny", message: formatViolationDeniedMessage(blockedTarget) };
       }
 
       const nextConfig = cloneRuntimeConfig(runtimeConfig);
@@ -1619,18 +1820,163 @@ async function handleFilesystemViolation(options: {
       if (decision === "allow-retry") {
         return {
           kind: "allow-retry",
-          message: formatFilesystemAllowRetryMessage(target),
-          retrySuccessMessage: formatFilesystemRetrySucceededMessage(target),
-          retryFailureMessage: formatFilesystemRetryFailedMessage(target),
-          retrySkippedMessage: formatFilesystemRetrySkippedMessage(target),
+          message: formatViolationAllowRetryMessage(blockedTarget),
+          retrySuccessMessage: formatViolationRetrySucceededMessage(blockedTarget),
+          retryFailureMessage: formatViolationRetryFailedMessage(blockedTarget),
+          retrySkippedMessage: formatViolationRetrySkippedMessage(blockedTarget),
         };
       }
 
       return {
         kind: "allow-adapt",
         message: changed
-          ? formatFilesystemAllowAdaptMessage(target)
-          : formatFilesystemAlreadyAllowedMessage(target),
+          ? formatViolationAllowAdaptMessage(blockedTarget)
+          : formatViolationAlreadyAllowedMessage(blockedTarget),
+      };
+    } catch {
+      return null;
+    }
+  })();
+
+  if (!pendingPrompts) return promptTask;
+
+  pendingPrompts.set(promptKey, promptTask);
+  try {
+    return await promptTask;
+  } finally {
+    pendingPrompts.delete(promptKey);
+  }
+}
+
+function buildMachLookupAllowCommand(service: string): string {
+  return `/sandbox mach-lookup add ${escapeSlashCommandArg(service)}`;
+}
+
+function formatMachLookupViolationSummary(service: string): string {
+  return `[sandbox] Blocked macOS service lookup: ${service}`;
+}
+
+function describeMachLookupEventSummary(
+  reason: SandboxEventReason,
+  outcome: SandboxEventOutcome,
+): string {
+  if (outcome === "allowed") return "user allowed macOS service lookup for this session";
+  if (reason === "already-approved-still-failed") {
+    return "macOS service lookup was previously allowed for this session but is still failing";
+  }
+  return "macOS service lookup is not in the allowed service list";
+}
+
+async function handleMachLookupViolation(options: {
+  pi: ExtensionAPI;
+  ctx: ExtensionContext | null;
+  promptMode: PromptMode;
+  runtimeConfig: SandboxRuntimeConfig;
+  violations: MachLookupViolation[];
+  command: string;
+  cwd?: string;
+  pendingPrompts?: Map<string, Promise<ViolationResolution | null>>;
+  applyRuntimeConfigForSession?: (
+    ctx: ExtensionContext,
+    runtimeConfig: SandboxRuntimeConfig,
+  ) => void;
+  recordEvent?: (event: SandboxEvent) => void;
+  autoRetryAvailable?: boolean;
+}): Promise<ViolationResolution | null> {
+  const {
+    pi,
+    ctx,
+    promptMode,
+    runtimeConfig,
+    violations,
+    command,
+    cwd,
+    pendingPrompts,
+    applyRuntimeConfigForSession,
+    recordEvent,
+    autoRetryAvailable = true,
+  } = options;
+  if (violations.length === 0) return null;
+
+  const violation =
+    violations.find((candidate) => !isMachLookupAlreadyAllowed(runtimeConfig, candidate.service)) ??
+    violations[0];
+  const { service } = violation;
+  const blockedTarget = formatMachLookupBlockedTarget(service);
+  const allowCommand = buildMachLookupAllowCommand(service);
+  const alreadyApproved = isMachLookupAlreadyAllowed(runtimeConfig, service);
+  const eventReason: SandboxEventReason = alreadyApproved
+    ? "already-approved-still-failed"
+    : "missing-mach-lookup";
+
+  const recordMachLookupEvent = (outcome: SandboxEventOutcome): void => {
+    recordEvent?.({
+      timestamp: Date.now(),
+      kind: "mach-lookup",
+      outcome,
+      reason: eventReason,
+      target: service,
+      command,
+      cwd,
+      summary: describeMachLookupEventSummary(eventReason, outcome),
+      suggestedCommand: outcome === "blocked" && !alreadyApproved ? allowCommand : undefined,
+    });
+  };
+
+  if (promptMode === "non-interactive" || !ctx?.hasUI) {
+    recordMachLookupEvent("blocked");
+    return {
+      kind: "deny",
+      message: `${formatMachLookupViolationSummary(service)}\n[sandbox] To temporarily allow for this session, run: ${allowCommand}`,
+    };
+  }
+
+  if (alreadyApproved) {
+    recordMachLookupEvent("blocked");
+    return { kind: "allow-adapt", message: formatViolationAlreadyAllowedMessage(blockedTarget) };
+  }
+
+  const promptKey = `${allowCommand}:${autoRetryAvailable ? "retry" : "adapt"}`;
+  const existingPrompt = pendingPrompts?.get(promptKey);
+  if (existingPrompt) return existingPrompt;
+
+  const promptTask: Promise<ViolationResolution | null> = (async () => {
+    try {
+      const selection = await withPromptSignal(pi, () =>
+        ctx.ui.select(
+          `Sandbox blocked access to macOS service ${service}`,
+          getViolationPromptOptions(autoRetryAvailable),
+        ),
+      );
+      const decision = parseViolationPromptSelection(selection, autoRetryAvailable);
+      if (decision === "deny") {
+        recordMachLookupEvent("blocked");
+        return { kind: "deny", message: formatViolationDeniedMessage(blockedTarget) };
+      }
+
+      const nextConfig = cloneRuntimeConfig(runtimeConfig);
+      const changed = mutateMachLookupAllowList(nextConfig, "add", service);
+      if (changed) {
+        applyRuntimeConfigForSession?.(ctx, nextConfig);
+      }
+
+      recordMachLookupEvent("allowed");
+
+      if (decision === "allow-retry") {
+        return {
+          kind: "allow-retry",
+          message: formatViolationAllowRetryMessage(blockedTarget),
+          retrySuccessMessage: formatViolationRetrySucceededMessage(blockedTarget),
+          retryFailureMessage: formatViolationRetryFailedMessage(blockedTarget),
+          retrySkippedMessage: formatViolationRetrySkippedMessage(blockedTarget),
+        };
+      }
+
+      return {
+        kind: "allow-adapt",
+        message: changed
+          ? formatViolationAllowAdaptMessage(blockedTarget)
+          : formatViolationAlreadyAllowedMessage(blockedTarget),
       };
     } catch {
       return null;
@@ -1664,17 +2010,20 @@ interface BashAttemptResult {
   exitCode: number | null;
   combinedOutput: string;
   interruptedByFilesystemViolation: boolean;
+  runtimeProtectedWriteViolations: FilesystemViolation[];
 }
 
 interface ProcessedSandboxAttempt {
   exitCode: number | null;
   postamble: string;
-  resolution: FilesystemViolationResolution | null;
+  resolution: ViolationResolution | null;
+  runtimeProtectedWriteViolations: FilesystemViolation[];
 }
 
 interface PreparedSandboxAttempt {
   attempt: BashAttemptResult;
   existingViolationCount: number;
+  runtimeConfig: SandboxRuntimeConfig | null;
 }
 
 function killProcessGroup(
@@ -1740,7 +2089,8 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     applyRuntimeConfigForSession,
     recordEvent,
   } = options;
-  const pendingFilesystemPrompts = new Map<string, Promise<FilesystemViolationResolution | null>>();
+  const pendingFilesystemPrompts = new Map<string, Promise<ViolationResolution | null>>();
+  const pendingMachLookupPrompts = new Map<string, Promise<ViolationResolution | null>>();
 
   let executionQueue: Promise<void> = Promise.resolve();
 
@@ -1763,6 +2113,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     command: string,
     wrappedCommand: string,
     cwd: string,
+    runtimeConfig: SandboxRuntimeConfig | null,
     onData: (data: Buffer) => void,
     existingViolationCount: number,
     signal?: AbortSignal,
@@ -1781,6 +2132,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
       let timedOut = false;
       let interruptedByFilesystemViolation = false;
       let seenViolationCount = existingViolationCount;
+      const runtimeProtectedWriteViolations = new Map<string, FilesystemViolation>();
       let timeoutHandle: NodeJS.Timeout | undefined;
       let timeoutEscalationHandle: NodeJS.Timeout | undefined;
       let filesystemStopEscalationHandle: NodeJS.Timeout | undefined;
@@ -1795,11 +2147,9 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         }, 500);
       };
 
-      // sandbox-runtime only provides live filesystem violation events on macOS.
-      // Upstream documents Linux violation monitoring as future work via
-      // automatic strace-based detection integrated with the violation store,
-      // but there is no Linux implementation yet:
-      // https://github.com/anthropic-experimental/sandbox-runtime#known-limitations-and-future-work
+      // The Linux monitor filters attempts against configured write rules and does not
+      // report mandatory runtime denies within already-allowed paths, so runtime-protected
+      // continuation remains macOS-only.
       const unsubscribeViolations =
         process.platform !== "darwin"
           ? () => undefined
@@ -1811,14 +2161,23 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
               const newViolations = violations.slice(seenViolationCount);
               seenViolationCount = violations.length;
 
-              const runtimeConfig = getRuntimeConfig();
-              const shouldStop = newViolations.some((violation) => {
+              for (const violation of newViolations) {
                 const filesystemViolation = detectFilesystemViolationFromLine(violation.line);
-                if (!filesystemViolation) return false;
-                return !isTraversalViolation(runtimeConfig, filesystemViolation, cwd);
-              });
-              if (shouldStop) {
-                stopForFilesystemViolation();
+                if (filesystemViolation) {
+                  if (isTraversalViolation(runtimeConfig, filesystemViolation, cwd)) continue;
+
+                  if (isRuntimeProtectedWriteViolation(runtimeConfig, filesystemViolation, cwd)) {
+                    if (filesystemViolation.path) {
+                      runtimeProtectedWriteViolations.set(
+                        filesystemViolation.path,
+                        filesystemViolation,
+                      );
+                    }
+                    continue;
+                  }
+
+                  stopForFilesystemViolation();
+                }
               }
             });
 
@@ -1881,6 +2240,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
           exitCode: interruptedByFilesystemViolation && code === null ? 1 : code,
           combinedOutput: Buffer.concat(chunks).toString("utf-8"),
           interruptedByFilesystemViolation,
+          runtimeProtectedWriteViolations: Array.from(runtimeProtectedWriteViolations.values()),
         });
       });
     });
@@ -1928,7 +2288,13 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
       applyRuntimeConfigForSession,
     });
 
-    const wrappedCommand = await SandboxManager.wrapWithSandbox(command);
+    const runtimeConfig = getRuntimeConfig();
+    const attemptRuntimeConfig = runtimeConfig ? cloneRuntimeConfig(runtimeConfig) : null;
+    const wrappedCommand = await SandboxManager.wrapWithSandbox(
+      command,
+      IS_MACOS ? MACOS_SANDBOX_SHELL : undefined,
+      attemptRuntimeConfig ?? undefined,
+    );
     const existingViolationCount =
       SandboxManager.getSandboxViolationStore().getViolationsForCommand(command).length;
 
@@ -1937,13 +2303,14 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         command,
         wrappedCommand,
         cwd,
+        attemptRuntimeConfig,
         onData,
         existingViolationCount,
         signal,
         timeout,
         env,
       );
-      return { attempt, existingViolationCount };
+      return { attempt, existingViolationCount, runtimeConfig: attemptRuntimeConfig };
     } catch (err) {
       safeCleanupAfterCommand();
       throw err;
@@ -1955,42 +2322,95 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
     command: string;
     cwd: string;
     existingViolationCount: number;
+    runtimeConfig: SandboxRuntimeConfig | null;
     autoRetryAvailable: boolean;
   }): Promise<ProcessedSandboxAttempt> {
-    const { attempt, command, cwd, existingViolationCount, autoRetryAvailable } = options;
-    const commandSucceeded = attempt.exitCode === 0 && !attempt.interruptedByFilesystemViolation;
-    if (commandSucceeded) {
-      return { exitCode: attempt.exitCode, postamble: "", resolution: null };
-    }
-
+    const { attempt, command, cwd, existingViolationCount, runtimeConfig, autoRetryAvailable } =
+      options;
     const annotatedOutput = SandboxManager.annotateStderrWithSandboxFailures(
       command,
       attempt.combinedOutput,
     );
-    const runtimeConfig = getRuntimeConfig();
-    const traversalPaths = getTraversalPaths({
+    // Capture violations delivered after the child closed but before post-processing.
+    const storedViolationLines = SandboxManager.getSandboxViolationStore()
+      .getViolationsForCommand(command)
+      .slice(existingViolationCount)
+      .map((violation) => violation.line);
+    const storedFilesystemViolations = storedViolationLines
+      .map((line) => detectFilesystemViolationFromLine(line))
+      .filter((violation): violation is FilesystemViolation => violation !== null);
+    const runtimeProtectedWriteViolations = getRuntimeProtectedWriteViolations(
       runtimeConfig,
-      output: annotatedOutput,
+      [...attempt.runtimeProtectedWriteViolations, ...storedFilesystemViolations],
       cwd,
-      skipViolationLines: existingViolationCount,
-    });
-    const effectiveExitCode = traversalPaths ? 0 : attempt.exitCode;
+    );
+    const machLookupViolations = detectMachLookupViolations(storedViolationLines);
     let postamble = extractAppendedSandboxAnnotation(
       attempt.combinedOutput,
       annotatedOutput,
       existingViolationCount,
     );
-    let resolution: FilesystemViolationResolution | null = null;
 
-    if (traversalPaths) {
-      const notice = formatTraversalNotice(traversalPaths);
+    if (runtimeProtectedWriteViolations.length > 0) {
+      const notice = formatRuntimeProtectedWriteNotice(
+        runtimeProtectedWriteViolations,
+        !attempt.interruptedByFilesystemViolation,
+      );
       postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
-    } else if (runtimeConfig) {
+
+      for (const violation of runtimeProtectedWriteViolations) {
+        recordEvent?.({
+          timestamp: Date.now(),
+          kind: "filesystem",
+          outcome: "blocked",
+          reason: "runtime-protected-write",
+          target: violation.path,
+          command,
+          cwd,
+          summary: "filesystem write is protected by the sandbox runtime",
+        });
+      }
+    }
+
+    const commandSucceeded = attempt.exitCode === 0 && !attempt.interruptedByFilesystemViolation;
+    if (commandSucceeded) {
+      return {
+        exitCode: attempt.exitCode,
+        postamble,
+        resolution: null,
+        runtimeProtectedWriteViolations,
+      };
+    }
+
+    const traversalPaths = getTraversalPaths({
+      runtimeConfig,
+      output: annotatedOutput,
+      cwd,
+      skipViolationLines: existingViolationCount,
+    });
+    const continuedTraversal = machLookupViolations.length === 0 ? traversalPaths : null;
+    const effectiveExitCode = continuedTraversal ? 0 : attempt.exitCode;
+    let resolution: ViolationResolution | null = null;
+
+    if (continuedTraversal) {
+      const notice = formatTraversalNotice(continuedTraversal);
+      postamble = appendOutputPostamble(postamble, notice, attempt.combinedOutput);
+    } else {
+      const currentRuntimeConfig = getRuntimeConfig();
+      if (!currentRuntimeConfig) {
+        return {
+          exitCode: effectiveExitCode,
+          postamble,
+          resolution,
+          runtimeProtectedWriteViolations,
+        };
+      }
+
       resolution = await handleFilesystemViolation({
         pi,
         ctx: getContext(),
         promptMode: getPromptMode(),
-        runtimeConfig,
+        runtimeConfig: currentRuntimeConfig,
         output: annotatedOutput,
         rawOutput: attempt.combinedOutput,
         command,
@@ -2000,14 +2420,37 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
         existingViolationCount,
         recordEvent,
         autoRetryAvailable,
+        runtimeProtectedWriteViolations,
+        allowOutputFallback: machLookupViolations.length === 0,
       });
 
+      if (!resolution) {
+        resolution = await handleMachLookupViolation({
+          pi,
+          ctx: getContext(),
+          promptMode: getPromptMode(),
+          runtimeConfig: currentRuntimeConfig,
+          violations: machLookupViolations,
+          command,
+          cwd,
+          pendingPrompts: pendingMachLookupPrompts,
+          applyRuntimeConfigForSession,
+          recordEvent,
+          autoRetryAvailable,
+        });
+      }
+
       if (resolution) {
         postamble = appendOutputPostamble(postamble, resolution.message, attempt.combinedOutput);
       }
     }
 
-    return { exitCode: effectiveExitCode, postamble, resolution };
+    return {
+      exitCode: effectiveExitCode,
+      postamble,
+      resolution,
+      runtimeProtectedWriteViolations,
+    };
   }
 
   return {
@@ -2035,6 +2478,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             command,
             cwd,
             existingViolationCount: initialRun.existingViolationCount,
+            runtimeConfig: initialRun.runtimeConfig,
             autoRetryAvailable: true,
           });
         } catch (postProcessError) {
@@ -2079,6 +2523,7 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             command,
             cwd,
             existingViolationCount: retryRun.existingViolationCount,
+            runtimeConfig: retryRun.runtimeConfig,
             autoRetryAvailable: false,
           });
         } catch (postProcessError) {
@@ -2094,7 +2539,10 @@ function createSandboxedBashOps(options: SandboxedBashOpsOptions): BashOperation
             retryResolution.retrySuccessMessage,
             retryRun.attempt.combinedOutput,
           );
-        } else if (!processedRetry.resolution) {
+        } else if (
+          !processedRetry.resolution &&
+          processedRetry.runtimeProtectedWriteViolations.length === 0
+        ) {
           retryPostamble = appendOutputPostamble(
             retryPostamble,
             retryResolution.retryFailureMessage,
@@ -2185,6 +2633,9 @@ function describeFilesystemEventSummary(
 
   if (reason === "explicit-deny-read") return "filesystem read matched a deny-read rule";
   if (reason === "explicit-deny-write") return "filesystem write matched a deny-write rule";
+  if (reason === "runtime-protected-write") {
+    return "filesystem write is protected by the sandbox runtime";
+  }
   if (reason === "already-approved-still-failed") {
     return "filesystem access was previously allowed for this session but is still failing";
   }
@@ -2767,7 +3218,7 @@ export default function (pi: ExtensionAPI) {
 
         setSandboxStatus(ctx, true, runtimeConfig, promptMode);
 
-        notify(ctx, "Sandbox enabled", "info");
+        announceSandboxState(pi, ctx, true);
         return;
       }
 
@@ -2797,7 +3248,7 @@ export default function (pi: ExtensionAPI) {
           return;
         }
 
-        notify(ctx, "Sandbox disabled", "info");
+        announceSandboxState(pi, ctx, false);
         return;
       }
 
@@ -2825,6 +3276,13 @@ export default function (pi: ExtensionAPI) {
           `    allowLocalBinding: ${runtimeConfig.network.allowLocalBinding ? "true" : "false"}`,
           `    allowAllUnixSockets: ${runtimeConfig.network.allowAllUnixSockets ? "true" : "false"}`,
           `    allowUnixSockets: ${runtimeConfig.network.allowUnixSockets?.join(", ") || "(none)"}`,
+          ...(IS_MACOS
+            ? [
+                "",
+                "  macOS service lookup (mach-lookup):",
+                `    Allowed: ${runtimeConfig.network.allowMachLookup?.join(", ") || "(none)"}`,
+              ]
+            : []),
           "",
           "  Filesystem:",
           `    Deny Read: ${runtimeConfig.filesystem.denyRead.join(", ") || "(none)"}`,
@@ -2903,6 +3361,42 @@ export default function (pi: ExtensionAPI) {
         return;
       }
 
+      if (subcommand === "mach-lookup") {
+        if (!IS_MACOS) {
+          notify(ctx, "Mach service lookup controls are only available on macOS.", "warning");
+          return;
+        }
+
+        const runtimeConfig = requireRuntimeConfig(ctx, sandboxState);
+        if (!runtimeConfig) return;
+
+        const op = tokens[1]?.toLowerCase() as ListOp | undefined;
+        const service = tokens[2]?.trim() ?? "";
+
+        if (
+          (op !== "add" && op !== "remove") ||
+          tokens.length !== 3 ||
+          !isValidMachLookupRule(service)
+        ) {
+          notify(ctx, "Usage: /sandbox mach-lookup <add|remove> <service>", "warning");
+          return;
+        }
+
+        const nextConfig = cloneRuntimeConfig(runtimeConfig);
+        const changed = mutateMachLookupAllowList(nextConfig, op, service);
+        if (!changed) {
+          notify(
+            ctx,
+            `No change: mach-lookup allow list already ${op === "add" ? "contains" : "omits"} ${service}`,
+          );
+          return;
+        }
+
+        applyRuntimeConfigForSession(ctx, nextConfig);
+        notify(ctx, `Updated mach-lookup allow list (${op}: ${service})`, "info");
+        return;
+      }
+
       if (subcommand === "filesystem") {
         const runtimeConfig = requireRuntimeConfig(ctx, sandboxState);
         if (!runtimeConfig) return;