toolroll 0.9.69 → 0.9.70

package/dist/agentconfig.js

@@ -22,6 +22,7 @@
 import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessHere } from "./check-access.js";
+import { PROJECT_SANDBOX_DEFAULT } from "./project-sandbox.js";
 import { isProviderId, validateSpec } from "./provider.js";
 import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
@@ -203,7 +204,11 @@ export function resolveScopeProfile(store, repo, ref, flags, platform = process.
     // How far its checks reach (check-access.ts): the project's setting as checks can get it (sign-ins, off for now,
     // seal as sandboxed: an approval never claims what its checks won't get), sealed only when wider than sandboxed.
     const checkAccess = repo === null ? "sandboxed" : checkAccessHere(store.projectCheckAccess(repo), platform);
-    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }) }, provenance: { resolvedFrom: build.source, repairFrom } };
+    // The fence policy (sandbox parity, docs/plans/sandbox-parity.md §1.5): every new scope is v2; and the project's
+    // sandbox settings (project-sandbox.ts), sealed when it lists any.
+    const sandbox = repo === null ? PROJECT_SANDBOX_DEFAULT : store.projectSandbox(repo);
+    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }), fencePolicy: 2,
+            ...(sandbox.readDeny.length === 0 ? {} : { readDeny: [...sandbox.readDeny] }), ...(sandbox.machLookup.length === 0 ? {} : { machLookup: [...sandbox.machLookup] }) }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {

package/dist/browser/THIRD_PARTY_NOTICES.txt

@@ -489,6 +489,27 @@ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
 OTHER DEALINGS IN THE FONT SOFTWARE.
 
+## Anthropic sandbox-runtime — Apache-2.0
+
+Copyright Anthropic PBC. https://github.com/anthropics/sandbox-runtime
+
+`@anthropic-ai/sandbox-runtime` 0.0.79 is a dependency, installed whole from npm with its own `LICENSE` (and its
+prebuilt Linux seccomp helpers, `vendor/seccomp/<arch>/apply-seccomp`). Toolroll calls it for every sandbox it runs
+(`src/sandbox-runtime.ts`, `src/sandbox-launch.ts`) and copies or modifies none of its code.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 ## Bundled dependency: @floating-ui/core 1.8.0
 
 MIT License

package/dist/builder.js

@@ -51,6 +51,7 @@ import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
+import { launchSandboxOf, protectedChanges, protectedLinks } from "./agent-fence.js";
 import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
@@ -273,7 +274,7 @@ function commandRunner(store, runId, profile, inner) {
     // it first) so a later check of its result never runs wider; under sign-ins, behind its checks' own network.
     const { access, network } = checkLaunchOf(store, runId, profile);
     store.stampRunCheckAccess(runId, access, network);
-    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined);
+    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined, launchSandboxOf(profile));
 }
 /** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
  * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
@@ -1376,7 +1377,7 @@ export async function build(store, request) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -2720,7 +2721,7 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2935,7 +2936,7 @@ async function ingestPark(args) {
                 ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
                 : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
-            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile), sandbox: launchSandboxOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -3506,6 +3507,25 @@ async function commit(git, worktree, branch, taskId, scope, summary, preparedCan
                 return { ok: true, committed: false, branch, summary };
         }
     }
+    // The protected names' backstop: a result that wrote a hook, Git config, editor or tool settings, a shell profile or
+    // an `.envrc` is refused, however it got written (the sandbox runtime holds the names there when a launch starts; one
+    // made after that, or by Codex, gets through it). The checkout is kept; nothing is committed.
+    const staged = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--name-only", "--no-renames", "-z"], { cwd: worktree });
+    if (staged.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(staged.stderr) };
+    // And any staged link at a protected name or a folder on the way to one (mode 120000, from the raw listing).
+    const raw = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--raw", "--no-renames", "-z"], { cwd: worktree });
+    if (raw.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(raw.stderr) };
+    const rawParts = raw.stdout.split("\0");
+    const links = [];
+    for (let at = 0; at + 1 < rawParts.length; at += 2)
+        if (rawParts[at].split(" ")[1] === "120000")
+            links.push(rawParts[at + 1]);
+    const forbidden = [...new Set([...protectedChanges(staged.stdout.split("\0").filter(one => one !== "")), ...protectedLinks(links)])];
+    if (forbidden.length > 0) {
+        return { ok: false, reason: "commit-failure", message: `The result changes ${forbidden.slice(0, 3).join(", ")}${forbidden.length > 3 ? ` and ${forbidden.length - 3} more` : ""}, which builds may not write (they run code or change tools for whoever opens the project next). Nothing was committed; the work is kept in ${worktree}.` };
+    }
     // Setup can create untracked files as well as edit tracked manifests.
     // Re-prove the whole staged tree after the normal path exclusions, before
     // committing, so neither can widen an exact prepared candidate.

package/dist/check-access.d.ts

@@ -30,15 +30,12 @@ export declare function narrowestNetwork(a: NetworkProfile, b: NetworkProfile):
 /** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
  * its checks'); narrower if a project host happens to be one of them. */
 export declare function checkNetworkOf(sealed: NetworkProfile, provider: string, project: ProjectNetwork): NetworkProfile;
-/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
- * has no openat), and each review round found another way a build or a check could swap a folder on that path between
- * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
- * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
- * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
- * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
- * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
-export declare const SIGN_INS_READY = false;
-export declare const signInsAvailable: (platform?: NodeJS.Platform) => boolean;
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export declare const SIGN_INS_READY = true;
+export declare const signInsAvailable: (_platform?: NodeJS.Platform) => boolean;
 /** Why sign-ins can't be chosen here, said plainly (null: they can). */
 export declare const signInsUnavailableWords: (platform?: NodeJS.Platform) => string | null;
 /** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never

package/dist/check-access.js

@@ -21,7 +21,7 @@ export function checkAccessWords(level) {
 }
 /** What each wider level means, said before anyone chooses it. */
 export const CHECK_ACCESS_WARNINGS = {
-    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
     unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
 };
 /** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
@@ -57,15 +57,12 @@ export function checkNetworkOf(sealed, provider, project) {
     const agent = new Set((PROVIDER_HOSTS[provider] ?? []).filter(host => !project.hosts.includes(host)));
     return { ...sealed, hosts: sealed.hosts.filter(host => !agent.has(host)) };
 }
-/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
- * has no openat), and each review round found another way a build or a check could swap a folder on that path between
- * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
- * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
- * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
- * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
- * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
-export const SIGN_INS_READY = false;
-export const signInsAvailable = (platform = process.platform) => SIGN_INS_READY && platform !== "linux";
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export const SIGN_INS_READY = true;
+export const signInsAvailable = (_platform = process.platform) => SIGN_INS_READY;
 /** Why sign-ins can't be chosen here, said plainly (null: they can). */
 export const signInsUnavailableWords = (platform = process.platform) => signInsAvailable(platform) ? null
     : "Not available yet: sign-ins can't be shared with checks safely. Choose Sandboxed or Not sandboxed.";

package/dist/coding-provider.d.ts

@@ -1,3 +1,5 @@
+import type { CodingPermissions } from "./coding-workspace.js";
+import type { Store } from "./store.js";
 import { type ProcessObservationFailure } from "./process-tree.js";
 /** Read-only recovery witnesses, never authority to signal historical PIDs.
  * macOS ancestry is observational; a missed/failed observation stays fenced.
@@ -70,3 +72,15 @@ export declare function createCodexCodingProvider(options?: {
     command?: string;
     args?: string[];
 }): CodingProvider;
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export declare function codingSessionPermissions(store: Pick<Store, "databaseFile" | "listWorktrees" | "projectSandbox">, worktreeRoot: string): (input: {
+    repo: string;
+    worktree: string;
+}) => CodingPermissions;

package/dist/coding-provider.js

@@ -1,6 +1,10 @@
 import { spawn } from "node:child_process";
 import { TextDecoder } from "node:util";
-import { hostname } from "node:os";
+import { homedir, hostname } from "node:os";
+import { readDenyPath } from "./project-sandbox.js";
+import { dirname, join } from "node:path";
+import { codexFenceConfig, fenceFor, FENCE_POLICY_CURRENT, runFolders, taskBoundary, trustedWorktreeBinding } from "./agent-fence.js";
+import { poolRootOf } from "./worktree.js";
 import { currentBootId } from "./boot-identity.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
@@ -423,3 +427,31 @@ export function createCodexCodingProvider(options = {}) {
         close,
     };
 }
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export function codingSessionPermissions(store, worktreeRoot) {
+    return input => sessionPermissions(store, { ...input, worktreeRoot });
+}
+function sessionPermissions(store, input) {
+    const databaseFile = store.databaseFile();
+    if (databaseFile === null || databaseFile === "" || databaseFile === ":memory:")
+        return { problem: "The coding session has no state folder to fence, so it was not started." };
+    try {
+        const poolRoots = [join(dirname(databaseFile), "worktrees"), input.worktreeRoot, ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+        const binding = trustedWorktreeBinding(input.repo, input.worktree, poolRoots);
+        const boundary = taskBoundary({ worktree: input.worktree, provider: "codex", binding, policy: FENCE_POLICY_CURRENT });
+        // The project's read denies, read live (a session seals none; they only narrow).
+        const readDeny = store.projectSandbox(input.repo).readDeny.map(one => readDenyPath(one, homedir()));
+        const launch = fenceFor("build", { databaseFile, worktree: input.worktree, boundary, binding, runFolders: runFolders(null), poolRoots, readDeny, policy: FENCE_POLICY_CURRENT });
+        return { config: codexFenceConfig(launch.fence, false, launch.fenceGrants) };
+    }
+    catch {
+        return { problem: "The session's worktree couldn't be bound to its project, so the session was not started." };
+    }
+}

package/dist/coding-workspace.d.ts

@@ -24,9 +24,22 @@ export declare class CodingActionError extends Error {
 export declare class CodingStateConflictError extends CodingActionError {
     constructor(id: string);
 }
+/** How a session's commands are confined (coding-provider.ts codingSessionPermissions): Toolroll's permission profile as
+ * the thread's config overrides, or a refusal. Required: no session starts without its caller saying which. */
+export type CodingPermissions = {
+    config: Record<string, unknown>;
+} | {
+    sandbox: 'workspace-write';
+} | {
+    problem: string;
+};
 type Options = {
     database: string;
     worktreeRoot: string;
+    permissions: (input: {
+        repo: string;
+        worktree: string;
+    }) => CodingPermissions;
     provider?: () => CodingProvider;
     admissionPaused?: () => boolean;
     authorize?: (actor: CodingActor, repo: string) => boolean;
@@ -92,6 +105,8 @@ export declare class CodingWorkspace {
     private putItem;
     private flush;
     private item;
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    private permissionsFor;
     private native;
     private request;
     private event;

package/dist/coding-workspace.js

@@ -278,6 +278,13 @@ export class CodingWorkspace {
         const clientId = string(item['clientId']) || string(item['clientUserMessageId']);
         return { id, type, text, status: string(item['status']) || null, ...(type === 'userMessage' && clientId ? { clientId } : {}) };
     }
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    permissionsFor(repo, worktree) {
+        const made = this.options.permissions({ repo, worktree });
+        if ('problem' in made)
+            throw Error(made.problem);
+        return made;
+    }
     native() {
         if (this.closed || this.closing || this.persistenceFailed)
             throw Error('The coding server cannot save activity. Reopen the workspace after the server recovers.');
@@ -445,7 +452,7 @@ export class CodingWorkspace {
             this.authorize(actor, repo);
             this.admit();
             nativeStartupAttempted = true;
-            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
+            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(repo, worktree), ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
             const thread = object(result['thread']), nativeThreadId = string(thread['id']);
             if (!nativeThreadId)
                 throw Error('The agent did not return a session identity.');
@@ -494,7 +501,7 @@ export class CodingWorkspace {
         this.authorize({ name: session.owner, generation: session.generation }, session.repo);
         if (session.context)
             verifyCodingContext(session.context, session.repo, session.base);
-        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
+        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(session.repo, session.worktree), ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
         const thread = object(result['thread']);
         if (thread['id'] !== session.nativeThreadId)
             throw Error('The agent returned a different conversation. Continuity could not be verified.');

package/dist/contracts/console-api.d.ts

@@ -85,6 +85,7 @@ export declare const CONSOLE_FORMS: {
     readonly projectNetwork: FormContract<"hosts" | "local" | "mode" | "password" | "repo">;
     readonly projectWrites: FormContract<"password" | "repo" | "writes">;
     readonly projectCheckAccess: FormContract<"confirm-open" | "level" | "password" | "repo">;
+    readonly projectSandbox: FormContract<"mach" | "password" | "read-deny" | "repo">;
     readonly projectDelete: FormContract<"name" | "password" | "repo" | "step">;
     readonly policy: FormContract<"ceiling" | "models" | "password" | "provider" | "tools">;
     readonly approval: FormContract<"not_requester" | "password" | "paths" | "protect" | "repo">;

package/dist/contracts/console-api.js

@@ -94,6 +94,7 @@ export const CONSOLE_FORMS = {
     projectNetwork: formContract("POST /settings/project/network", ["repo", "mode", "local", "hosts", "password"]),
     projectWrites: formContract("POST /settings/project/writes", ["repo", "writes", "password"]),
     projectCheckAccess: formContract("POST /settings/project/check-access", ["repo", "level", "confirm-open", "password"]),
+    projectSandbox: formContract("POST /settings/project/sandbox", ["repo", "read-deny", "mach", "password"]),
     projectDelete: formContract("POST /settings/project/delete", ["repo", "name", "step", "password"]),
     policy: formContract("POST /settings/policy", ["password", "provider", "models", "tools", "ceiling"]),
     approval: formContract("POST /settings/approval", ["repo", "password", "protect", "paths", "not_requester"]),

package/dist/doctor.d.ts

@@ -17,6 +17,13 @@ export type DoctorReport = {
     findings: DoctorFinding[];
     unreadable: DoctorUnreadable[];
     notes: string[];
+    /** The sandbox every build runs in (sandbox-runtime.ts): Anthropic's sandbox-runtime, its version, and why it can't
+     * sandbox here (null when it can). */
+    sandbox?: {
+        engine: string;
+        version: string;
+        problem: string | null;
+    };
 };
 export type DoctorDeps = {
     platform?: NodeJS.Platform;

package/dist/doctor.js

@@ -24,6 +24,7 @@ import { envelopeJson } from "./envelope.js";
 import { run as runCommand } from "./exec.js";
 import { OWN_KEY_ENV } from "./keys.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
+import { SANDBOX_RUNTIME, sandboxRuntimeProblem, sandboxRuntimeWords } from "./sandbox-runtime.js";
 /** Names that say they hold a credential. */
 const CREDENTIAL_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|SECRET|SECRET_?KEY|TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|CREDENTIALS?|PAT)(?:_|$)/i;
 /** Names that only point at one: a path, a socket, an address. */
@@ -401,6 +402,8 @@ export function doctorLines(report) {
     }
     for (const note of report.notes)
         lines.push("", `Note: ${note}`);
+    if (report.sandbox !== undefined)
+        lines.push("", `Sandbox: ${sandboxRuntimeWords()}${report.sandbox.problem === null ? ", working here." : `, not available here: ${report.sandbox.problem}. Builds don't start unless an instance operator allows unconfined agents.`}`);
     if (report.checked.length > 0)
         lines.push("", "Checked:", ...report.checked.map(one => `  ${one}`));
     return lines;
@@ -418,6 +421,7 @@ export async function runDoctorCommand(argv, write, deps = {}) {
         return 2;
     }
     const report = await auditServiceEnvironment(deps);
+    report.sandbox = { engine: SANDBOX_RUNTIME.name, version: SANDBOX_RUNTIME.version, problem: sandboxRuntimeProblem() };
     if (json)
         write(envelopeJson({ command: "doctor", ...report }));
     else

package/dist/egress.d.ts

@@ -96,6 +96,8 @@ export declare function runNetworkFromValue(value: unknown): RunNetworkRecord |
 export type EgressProxy = {
     /** The proxy's address with this run's credentials, for HTTPS_PROXY and the like. */
     url: string;
+    /** This run's credential alone: a client presenting it (with any user name: the sandbox runtime names its own) is served. */
+    secret: string;
     port: number;
     counts: () => EgressCounts;
     close: () => Promise<void>;

package/dist/egress.js

@@ -6,8 +6,8 @@
  * and the project's added hosts), and that snapshot is what the approval binds and the launch enforces. Nothing at
  * launch re-derives it from settings changed since or from files the agent wrote.
  *
- * The launch enforces it at the operating system (agent-fence.ts: Seatbelt's network rules on macOS, a network
- * namespace on Linux) and reaches the world through one proxy of its own (startEgressProxy), which admits only the
+ * The launch enforces it at the operating system (Anthropic's sandbox-runtime: its Seatbelt network rules on macOS, a
+ * network namespace on Linux with the proxy relayed in) and reaches the world through one proxy of its own (startEgressProxy), which admits only the
  * snapshot's hosts. The proxy never decrypts TLS: it restricts where a build connects, not what it sends there.
  */
 import { createServer, request as httpRequest } from "node:http";
@@ -272,7 +272,7 @@ export async function startEgressProxy(options) {
     const upstreamPort = options.upstreamPort ?? ((port) => port);
     const lookup = options.lookup ?? (async (host) => (await dnsLookup(host, { all: true, verbatim: true })).map(one => one.address));
     const secret = randomBytes(24).toString("base64url");
-    const expected = Buffer.from(`Basic ${Buffer.from(`run:${secret}`).toString("base64")}`);
+    const expected = Buffer.from(secret);
     const sockets = new Set();
     const byHost = new Map();
     let connections = 0, refused = 0, otherHosts = 0;
@@ -300,8 +300,16 @@ export async function startEgressProxy(options) {
         }
         catch { /* a listener's trouble is not the build's */ }
     };
+    /** Basic credentials whose password is this run's secret, whatever the user name (the sandbox runtime puts its own
+     * attribution there). */
     const authorized = (incoming) => {
-        const given = Buffer.from(String(incoming.headers["proxy-authorization"] ?? ""));
+        const header = String(incoming.headers["proxy-authorization"] ?? "");
+        const basic = /^Basic ([A-Za-z0-9+/=]+)$/.exec(header)?.[1];
+        if (basic === undefined)
+            return false;
+        const decoded = Buffer.from(basic, "base64").toString("utf8");
+        const colon = decoded.indexOf(":");
+        const given = Buffer.from(colon < 0 ? "" : decoded.slice(colon + 1));
         return given.length === expected.length && timingSafeEqual(given, expected);
     };
     /** The addresses a request may reach, or why it may not. */
@@ -412,6 +420,7 @@ export async function startEgressProxy(options) {
     const port = typeof address === "object" && address !== null ? address.port : 0;
     return {
         url: `http://run:${secret}@127.0.0.1:${port}`,
+        secret,
         port,
         counts: () => ({ connections, refused, hosts: [...byHost].map(([host, one]) => ({ host, ...one })).sort((a, b) => b.connections + b.refused - (a.connections + a.refused) || a.host.localeCompare(b.host)), otherHosts }),
         close: () => new Promise(done => {

package/dist/exec.d.ts

@@ -183,18 +183,24 @@ export declare class ContainmentRefusal extends Error {
     readonly name = "ContainmentRefusal";
 }
 /**
- * The command as it runs inside the agent fence (sandbox-exec or bubblewrap wrapping it), or as it is when it has no
- * fence. A spawn whose confinement is required and that no backend here can wrap is refused (ContainmentRefusal):
- * nothing runs, and nothing falls back to running it unwrapped.
+ * The command as it runs inside the agent fence (Anthropic's sandbox-runtime wrapping it: agent-fence.ts
+ * sandboxedSpawn), with the environment that needs beside the caller's, or as it is when it has no fence. A spawn whose
+ * confinement is required and that no sandbox here can wrap is refused (ContainmentRefusal): nothing runs, and nothing
+ * falls back to running it unwrapped.
  */
 export declare function confined(file: string, args: readonly string[], bag: {
     fence?: readonly string[] | undefined;
     fenceGrants?: FenceGrants | undefined;
     confinement?: "required" | undefined;
+    cwd?: string | undefined;
+    temp?: string | undefined;
 }): {
     file: string;
     args: string[];
+    env: Record<string, string>;
 };
+/** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
+export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>): T | Record<string, string | undefined> | undefined;
 /** Run IDs are local to a database. Connections to the same file share
  * custody; separate files and separate in-memory databases never do. */
 export declare function runOwnerTag(store: Store, runId: number): string;
@@ -298,6 +304,14 @@ export type AcpControl = {
         group: number;
     }[] | null;
 };
+/**
+ * Whether a listed process is the agent's launch (`names`): by its listed name, or on Linux by the program it runs,
+ * since a listing there shows the main thread's name, which Node 24 sets to "MainThread".
+ */
+export declare function agentNamed(row: {
+    pid: number;
+    name: string;
+}, names: readonly string[], programOf?: (pid: number) => string | null): boolean;
 /** How long each shutdown step waits: session/close's answer, then exit after stdin closes, then exit after SIGTERM. */
 export declare const ACP_SHUTDOWN_MS: {
     readonly close: 2000;

package/dist/exec.js

@@ -7,9 +7,9 @@
  * walks repos it has never seen, and one broken repo must not end the scan.
  */
 import { ACP_LINE_CAP, createAcpConversation } from "./acp-client.js";
-import { linuxFenceAvailable, linuxFenced, macosFenceAvailable, macosFenced } from "./agent-fence.js";
+import { linuxFenceAvailable, macosFenceAvailable, sandboxedSpawn } from "./agent-fence.js";
 import { execFile, execFileSync, spawn } from "node:child_process";
-import { realpathSync } from "node:fs";
+import { readlinkSync, realpathSync } from "node:fs";
 import { observeProcessTree, stopProcessTree } from "./process-tree.js";
 import { jsonlDiscriminants } from "./jsonl-discriminants.js";
 import { createContainer, currentContainment } from "./containment.js";
@@ -48,22 +48,35 @@ export class ContainmentRefusal extends Error {
     name = "ContainmentRefusal";
 }
 /**
- * The command as it runs inside the agent fence (sandbox-exec or bubblewrap wrapping it), or as it is when it has no
- * fence. A spawn whose confinement is required and that no backend here can wrap is refused (ContainmentRefusal):
- * nothing runs, and nothing falls back to running it unwrapped.
+ * The command as it runs inside the agent fence (Anthropic's sandbox-runtime wrapping it: agent-fence.ts
+ * sandboxedSpawn), with the environment that needs beside the caller's, or as it is when it has no fence. A spawn whose
+ * confinement is required and that no sandbox here can wrap is refused (ContainmentRefusal): nothing runs, and nothing
+ * falls back to running it unwrapped.
  */
 export function confined(file, args, bag) {
     const fence = bag.fence ?? [];
-    if (fence.length > 0 && macosFenceAvailable())
-        return macosFenced(file, args, fence, bag.fenceGrants);
-    if (fence.length > 0 && linuxFenceAvailable())
-        return linuxFenced(file, args, fence, bag.fenceGrants);
+    // A fence is only ever made by fenceFor (agent-fence.ts), which marks it required: one without the mark was put
+    // together some other way, and would run bare wherever no OS fence applies. Nothing runs.
+    if (fence.length > 0 && bag.confinement !== "required")
+        throw new ContainmentRefusal("This process was given a fence that isn't marked required, so it was not started.");
+    if (fence.length > 0 && (macosFenceAvailable() || linuxFenceAvailable())) {
+        try {
+            return sandboxedSpawn(file, args, fence, bag.fenceGrants, bag.cwd, bag.temp);
+        }
+        catch (error) {
+            throw new ContainmentRefusal(`The sandbox couldn't be made, so nothing was started: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
     if (bag.confinement === "required") {
         throw new ContainmentRefusal(fence.length === 0
             ? "This process must run inside the agent fence, and it was given none."
             : "This machine can't confine a build (no macOS sandbox, no working bubblewrap), so nothing was started.");
     }
-    return { file, args: [...args] };
+    return { file, args: [...args], env: {} };
+}
+/** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
+export function withSandboxEnv(env, added) {
+    return Object.keys(added).length === 0 ? env : { ...(env ?? process.env), ...added };
 }
 /** A spawn callback refused custody AFTER the child existed: the caller
  * must reap exactly this child before answering. */
@@ -92,7 +105,9 @@ function rejectedChild(error, child) {
  */
 function spawnContained(file, args, spawnOptions, label, bag, contain = true) {
     // The agent fence wraps the target itself (sandbox-exec then execs it, same pid).
-    ({ file, args } = confined(file, args, bag));
+    const sandboxed = confined(file, args, { ...bag, cwd: spawnOptions.cwd, temp: spawnOptions.env?.["TMPDIR"] });
+    ({ file, args } = sandboxed);
+    spawnOptions = { ...spawnOptions, env: withSandboxEnv(spawnOptions.env, sandboxed.env) };
     // The policy refusal comes first: nothing is reserved, recorded or
     // spawned for a spawn that cannot be contained as required.
     const effective = contain ? currentContainment() : null;
@@ -553,7 +568,7 @@ export function run(file, args, options = {}) {
     // whose confinement is required and can't be wrapped refuses before anything runs.
     let wrapped;
     try {
-        wrapped = confined(file, args, options);
+        wrapped = confined(file, args, { ...options, cwd, temp: childEnv?.["TMPDIR"] });
     }
     catch (error) {
         if (!(error instanceof ContainmentRefusal))
@@ -568,7 +583,7 @@ export function run(file, args, options = {}) {
             encoding: "utf8",
             shell: false,
             windowsHide: true,
-            ...(childEnv === undefined ? {} : { env: childEnv }),
+            ...((env => env === undefined ? {} : { env }))(withSandboxEnv(childEnv, wrapped.env)),
         }, (error, stdout, stderr) => {
             if (error === null) {
                 resolve({ result: { code: 0, stdout, stderr, timedOut: false, notFound: false }, transient: false });
@@ -1373,7 +1388,7 @@ function processRows() {
  * wrapper around it), down to the agent's own process (the first whose command is the agent's launch, `names`), then
  * every live, non-zombie process beneath it, with its group. The agent itself and any wrapper are never counted.
  */
-function liveUnderAgent(root, names) {
+function liveUnderAgent(root, names, rootIsWrapper = false) {
     const rows = processRows();
     if (rows === null)
         return null;
@@ -1381,9 +1396,10 @@ function liveUnderAgent(root, names) {
     for (const row of rows)
         children.set(row.parent, [...(children.get(row.parent) ?? []), row]);
     const self = rows.find(row => row.pid === root);
-    const named = (row) => names.some(name => row.name === name || row.name.endsWith(`/${name}`));
+    const named = (row) => agentNamed(row, names);
     // The agent: the root when it is the agent (macOS sandbox-exec execs in place), else the first named descendant.
-    let agent = self !== undefined && named(self) ? root : null;
+    // On Linux the root is the sandbox launch helper (sandbox-launch.ts, itself node): never taken for the agent.
+    let agent = !rootIsWrapper && self !== undefined && named(self) ? root : null;
     const pending = [...(children.get(root) ?? [])];
     while (agent === null && pending.length > 0) {
         const row = pending.shift();
@@ -1404,6 +1420,27 @@ function liveUnderAgent(root, names) {
     }
     return found;
 }
+/** The program a Linux process runs (its /proc exe), or null: elsewhere, or unreadable. */
+function linuxProgramOf(pid) {
+    if (process.platform !== "linux")
+        return null;
+    try {
+        return readlinkSync(`/proc/${pid}/exe`).replace(/ \(deleted\)$/, "").split("/").pop() || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether a listed process is the agent's launch (`names`): by its listed name, or on Linux by the program it runs,
+ * since a listing there shows the main thread's name, which Node 24 sets to "MainThread".
+ */
+export function agentNamed(row, names, programOf = linuxProgramOf) {
+    if (names.some(name => row.name === name || row.name.endsWith(`/${name}`)))
+        return true;
+    const program = programOf(row.pid);
+    return program !== null && names.includes(program);
+}
 /** How long each shutdown step waits: session/close's answer, then exit after stdin closes, then exit after SIGTERM. */
 export const ACP_SHUTDOWN_MS = { close: 2_000, eof: 5_000, term: 5_000 };
 /** How long each handshake step (initialize, session/new, choosing the model) may take before the agent is stopped. */
@@ -1612,7 +1649,7 @@ export function runAcpSession(file, args, options = {}) {
                             forceKill();
                         });
                 },
-                liveDescendants: () => process.platform === "win32" ? null : exited() || child.pid === undefined ? [] : liveUnderAgent(child.pid, agentNames),
+                liveDescendants: () => process.platform === "win32" ? null : exited() || child.pid === undefined ? [] : liveUnderAgent(child.pid, agentNames, child.spawnargs.some(arg => arg.endsWith("sandbox-launch.js"))),
             });
         }
         catch { /* the caller's own failure */ }