toolroll 0.9.69 → 0.9.71

package/dist/agentconfig.js

@@ -22,6 +22,7 @@
 import { PROJECT_NETWORK_DEFAULT, repositoryEcosystems, resolveNetwork } from "./egress.js";
 import { WRITES_DEFAULT } from "./writes-mode.js";
 import { checkAccessHere } from "./check-access.js";
+import { PROJECT_SANDBOX_DEFAULT } from "./project-sandbox.js";
 import { isProviderId, validateSpec } from "./provider.js";
 import { ACP_LIMITS, CLAUDE_LIMITS, CODEX_SHAPED_LIMITS, GEMINI_LIMITS } from "./scope.js";
 import { ACP_AGENTS, isAcpProvider } from "./acp-agents.js";
@@ -203,7 +204,11 @@ export function resolveScopeProfile(store, repo, ref, flags, platform = process.
     // How far its checks reach (check-access.ts): the project's setting as checks can get it (sign-ins, off for now,
     // seal as sandboxed: an approval never claims what its checks won't get), sealed only when wider than sandboxed.
     const checkAccess = repo === null ? "sandboxed" : checkAccessHere(store.projectCheckAccess(repo), platform);
-    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }) }, provenance: { resolvedFrom: build.source, repairFrom } };
+    // The fence policy (sandbox parity, docs/plans/sandbox-parity.md §1.5): every new scope is v2; and the project's
+    // sandbox settings (project-sandbox.ts), sealed when it lists any.
+    const sandbox = repo === null ? PROJECT_SANDBOX_DEFAULT : store.projectSandbox(repo);
+    return { ok: true, profile: { ...profile, network, writes, ...(checkAccess === "sandboxed" ? {} : { checkAccess }), fencePolicy: 2,
+            ...(sandbox.readDeny.length === 0 ? {} : { readDeny: [...sandbox.readDeny] }), ...(sandbox.machLookup.length === 0 ? {} : { machLookup: [...sandbox.machLookup] }) }, provenance: { resolvedFrom: build.source, repairFrom } };
 }
 const PHASE_NOUN = { plan: "planner", build: "builder", repair: "repair", review: "reviewer" };
 export function resolveRouteCandidates(store, repo, pins = {}) {

package/dist/browser/THIRD_PARTY_NOTICES.txt

@@ -489,6 +489,27 @@ DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
 OTHER DEALINGS IN THE FONT SOFTWARE.
 
+## Anthropic sandbox-runtime — Apache-2.0
+
+Copyright Anthropic PBC. https://github.com/anthropics/sandbox-runtime
+
+`@anthropic-ai/sandbox-runtime` 0.0.79 is a dependency, installed whole from npm with its own `LICENSE` (and its
+prebuilt Linux seccomp helpers, `vendor/seccomp/<arch>/apply-seccomp`). Toolroll calls it for every sandbox it runs
+(`src/sandbox-runtime.ts`, `src/sandbox-launch.ts`) and copies or modifies none of its code.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+
+
 ## Bundled dependency: @floating-ui/core 1.8.0
 
 MIT License

package/dist/builder.js

@@ -51,6 +51,7 @@ import { stopRequestedFor, stopWords, underStopWatch } from "./task-control.js";
 import { witnessedRunner } from "./process-custody.js";
 import { runWithIsolatedDatabase } from "./child-database.js";
 import { recordWorktreeProcess, saveWorkPatch } from "./worktree.js";
+import { launchSandboxOf, protectedChanges, protectedLinks } from "./agent-fence.js";
 import { approvalOf, digestOf, idleClock, isAcpProfile, profileDigestOf, routeParityProblem, watchdogsOf } from "./scope.js";
 import { legOf, routeDigestOf, routeFromJson } from "./phase-routing.js";
 import { execFileSync } from "node:child_process";
@@ -273,7 +274,7 @@ function commandRunner(store, runId, profile, inner) {
     // it first) so a later check of its result never runs wider; under sign-ins, behind its checks' own network.
     const { access, network } = checkLaunchOf(store, runId, profile);
     store.stampRunCheckAccess(runId, access, network);
-    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined);
+    return fencedCommands(store, runId, launchWritesOf(profile), inner, undefined, access, network ?? undefined, launchSandboxOf(profile));
 }
 /** A build's checks' level and network: its approval's level as this platform can give it (sign-ins sealed before
  * run sandboxed while sign-ins are off, and the run is stamped with that, what actually ran), and under sign-ins the network its
@@ -1376,7 +1377,7 @@ export async function build(store, request) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             onSpawn: (pid) => { spawned = true; request.onProviderSpawn?.(pid); },
             onStreamEvent: (event) => liveLog.observe(event),
@@ -2720,7 +2721,7 @@ async function resumeUnhandedWork(captured, sessionId) {
             ...watchdogsOf(effective.profile, effective.timeoutMs),
             omitEnv: AGENT_ENV_DENYLIST,
             network: launchNetworkOf(store, request.taskRef, effective.profile),
-            writes: launchWritesOf(effective.profile),
+            writes: launchWritesOf(effective.profile), sandbox: launchSandboxOf(effective.profile),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -2935,7 +2936,7 @@ async function ingestPark(args) {
                 ? watchdogsOf(args.profile, args.profile.repairTimeoutSeconds * 1000, true)
                 : { timeoutMs: args.profile !== undefined ? args.profile.repairTimeoutSeconds * 1000 : REPAIR_TIMEOUT_MS }),
             omitEnv: AGENT_ENV_DENYLIST,
-            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile) }),
+            ...(args.profile === undefined ? {} : { network: launchNetworkOf(store, request.taskRef, args.profile), writes: launchWritesOf(args.profile), sandbox: launchSandboxOf(args.profile) }),
             ...(agent === undefined ? {} : { runner: agent }),
             ...(request.onProviderSpawn === undefined ? {} : { onSpawn: request.onProviderSpawn }),
             clock,
@@ -3506,6 +3507,25 @@ async function commit(git, worktree, branch, taskId, scope, summary, preparedCan
                 return { ok: true, committed: false, branch, summary };
         }
     }
+    // The protected names' backstop: a result that wrote a hook, Git config, editor or tool settings, a shell profile or
+    // an `.envrc` is refused, however it got written (the sandbox runtime holds the names there when a launch starts; one
+    // made after that, or by Codex, gets through it). The checkout is kept; nothing is committed.
+    const staged = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--name-only", "--no-renames", "-z"], { cwd: worktree });
+    if (staged.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(staged.stderr) };
+    // And any staged link at a protected name or a folder on the way to one (mode 120000, from the raw listing).
+    const raw = await git(GIT, ["--no-optional-locks", "diff", "--cached", "--raw", "--no-renames", "-z"], { cwd: worktree });
+    if (raw.code !== 0)
+        return { ok: false, reason: "commit-failure", message: firstLine(raw.stderr) };
+    const rawParts = raw.stdout.split("\0");
+    const links = [];
+    for (let at = 0; at + 1 < rawParts.length; at += 2)
+        if (rawParts[at].split(" ")[1] === "120000")
+            links.push(rawParts[at + 1]);
+    const forbidden = [...new Set([...protectedChanges(staged.stdout.split("\0").filter(one => one !== "")), ...protectedLinks(links)])];
+    if (forbidden.length > 0) {
+        return { ok: false, reason: "commit-failure", message: `The result changes ${forbidden.slice(0, 3).join(", ")}${forbidden.length > 3 ? ` and ${forbidden.length - 3} more` : ""}, which builds may not write (they run code or change tools for whoever opens the project next). Nothing was committed; the work is kept in ${worktree}.` };
+    }
     // Setup can create untracked files as well as edit tracked manifests.
     // Re-prove the whole staged tree after the normal path exclusions, before
     // committing, so neither can widen an exact prepared candidate.

package/dist/check-access.d.ts

@@ -30,15 +30,12 @@ export declare function narrowestNetwork(a: NetworkProfile, b: NetworkProfile):
 /** A build's checks' own network: what its approval sealed, less its agent's provider hosts (those are the agent's, never
  * its checks'); narrower if a project host happens to be one of them. */
 export declare function checkNetworkOf(sealed: NetworkProfile, provider: string, project: ProjectNetwork): NetworkProfile;
-/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
- * has no openat), and each review round found another way a build or a check could swap a folder on that path between
- * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
- * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
- * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
- * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
- * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
-export declare const SIGN_INS_READY = false;
-export declare const signInsAvailable: (platform?: NodeJS.Platform) => boolean;
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export declare const SIGN_INS_READY = true;
+export declare const signInsAvailable: (_platform?: NodeJS.Platform) => boolean;
 /** Why sign-ins can't be chosen here, said plainly (null: they can). */
 export declare const signInsUnavailableWords: (platform?: NodeJS.Platform) => string | null;
 /** The level checks actually get on this platform: `sign-ins` where it isn't available is `sandboxed` (narrower, never

package/dist/check-access.js

@@ -17,11 +17,11 @@ export const widerThan = (a, b) => RANK[a] > RANK[b];
 export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
 /** The level as a person reads it, in a sentence's middle ("Checks: …"). */
 export function checkAccessWords(level) {
-    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins and, on a Mac, Keychain access" : "not sandboxed";
 }
 /** What each wider level means, said before anyone chooses it. */
 export const CHECK_ACCESS_WARNINGS = {
-    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. On a Mac that includes Keychain access: they can read any keychain item that lets every program read it, not only those sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
     unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
 };
 /** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */
@@ -57,15 +57,12 @@ export function checkNetworkOf(sealed, provider, project) {
     const agent = new Set((PROVIDER_HOSTS[provider] ?? []).filter(host => !project.hosts.includes(host)));
     return { ...sealed, hosts: sealed.hosts.filter(host => !agent.has(host)) };
 }
-/** Off everywhere, for now (0.9.69): no `sign-ins`. Reading a sign-in file resolves its parent folders by path (Node
- * has no openat), and each review round found another way a build or a check could swap a folder on that path between
- * the checks and the read (on Linux a Claude build can write ~/.claude outright). Until that read is race-free, no
- * check gets sign-ins: setting the level is refused, a level saved or sealed before (or copied in from another
- * database) runs sandboxed, a scope seals sandboxed, and the sign-ins launch refuses first thing. The code behind it
- * (signInGrants, readGrantedFile, the copies, the network fence) stays, guarded, for when such a reader exists; flip
- * SIGN_INS_READY then (Linux stays off until its copies are race-free too). */
-export const SIGN_INS_READY = false;
-export const signInsAvailable = (platform = process.platform) => SIGN_INS_READY && platform !== "linux";
+/** On (0.9.70, sandbox parity C10): a `sign-ins` check reads its sign-in files itself, through its sandbox, by name
+ * (agent-fence.ts signInGrants). Nothing privileged reads or copies one, so the race that kept sign-ins off (a folder
+ * swapped between a privileged check and its read) has nothing to race; a link planted at a sign-in name leads, inside
+ * the sandbox's own view, to a denied path. Every platform with an OS fence. */
+export const SIGN_INS_READY = true;
+export const signInsAvailable = (_platform = process.platform) => SIGN_INS_READY;
 /** Why sign-ins can't be chosen here, said plainly (null: they can). */
 export const signInsUnavailableWords = (platform = process.platform) => signInsAvailable(platform) ? null
     : "Not available yet: sign-ins can't be shared with checks safely. Choose Sandboxed or Not sandboxed.";

package/dist/coding-provider.d.ts

@@ -1,3 +1,5 @@
+import type { CodingPermissions } from "./coding-workspace.js";
+import type { Store } from "./store.js";
 import { type ProcessObservationFailure } from "./process-tree.js";
 /** Read-only recovery witnesses, never authority to signal historical PIDs.
  * macOS ancestry is observational; a missed/failed observation stays fenced.
@@ -70,3 +72,15 @@ export declare function createCodexCodingProvider(options?: {
     command?: string;
     args?: string[];
 }): CodingProvider;
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export declare function codingSessionPermissions(store: Pick<Store, "databaseFile" | "listWorktrees" | "projectSandbox">, worktreeRoot: string): (input: {
+    repo: string;
+    worktree: string;
+}) => CodingPermissions;

package/dist/coding-provider.js

@@ -1,6 +1,10 @@
 import { spawn } from "node:child_process";
 import { TextDecoder } from "node:util";
-import { hostname } from "node:os";
+import { homedir, hostname } from "node:os";
+import { readDenyPath } from "./project-sandbox.js";
+import { dirname, join } from "node:path";
+import { codexFenceConfig, fenceFor, FENCE_POLICY_CURRENT, runFolders, taskBoundary, trustedWorktreeBinding } from "./agent-fence.js";
+import { poolRootOf } from "./worktree.js";
 import { currentBootId } from "./boot-identity.js";
 import { createContainer, currentContainment } from "./containment.js";
 import { processMayBeAlive } from "./process-liveness.js";
@@ -423,3 +427,31 @@ export function createCodexCodingProvider(options = {}) {
         close,
     };
 }
+/**
+ * An interactive Codex session's confinement (docs/plans/sandbox-parity.md C3): the permission profile a Codex build
+ * gets (agent-fence.ts codexFenceConfig), as the thread's config overrides: Toolroll's state, every other launch's
+ * folder and every other checkout in the plane's pools and the coding sessions' own pool denied, the session's own
+ * worktree given back; Codex's workspace writes; no network (Codex's command sandbox can't route through a proxy, and
+ * sessions have never had one). The worktree is bound to its project by the plane's own records first; anything that
+ * doesn't prove refuses the session.
+ */
+export function codingSessionPermissions(store, worktreeRoot) {
+    return input => sessionPermissions(store, { ...input, worktreeRoot });
+}
+function sessionPermissions(store, input) {
+    const databaseFile = store.databaseFile();
+    if (databaseFile === null || databaseFile === "" || databaseFile === ":memory:")
+        return { problem: "The coding session has no state folder to fence, so it was not started." };
+    try {
+        const poolRoots = [join(dirname(databaseFile), "worktrees"), input.worktreeRoot, ...store.listWorktrees().map(record => poolRootOf(record.path, record.repo))];
+        const binding = trustedWorktreeBinding(input.repo, input.worktree, poolRoots);
+        const boundary = taskBoundary({ worktree: input.worktree, provider: "codex", binding, policy: FENCE_POLICY_CURRENT });
+        // The project's read denies, read live (a session seals none; they only narrow).
+        const readDeny = store.projectSandbox(input.repo).readDeny.map(one => readDenyPath(one, homedir()));
+        const launch = fenceFor("build", { databaseFile, worktree: input.worktree, boundary, binding, runFolders: runFolders(null), poolRoots, readDeny, policy: FENCE_POLICY_CURRENT });
+        return { config: codexFenceConfig(launch.fence, false, launch.fenceGrants) };
+    }
+    catch {
+        return { problem: "The session's worktree couldn't be bound to its project, so the session was not started." };
+    }
+}

package/dist/coding-workspace.d.ts

@@ -24,9 +24,22 @@ export declare class CodingActionError extends Error {
 export declare class CodingStateConflictError extends CodingActionError {
     constructor(id: string);
 }
+/** How a session's commands are confined (coding-provider.ts codingSessionPermissions): Toolroll's permission profile as
+ * the thread's config overrides, or a refusal. Required: no session starts without its caller saying which. */
+export type CodingPermissions = {
+    config: Record<string, unknown>;
+} | {
+    sandbox: 'workspace-write';
+} | {
+    problem: string;
+};
 type Options = {
     database: string;
     worktreeRoot: string;
+    permissions: (input: {
+        repo: string;
+        worktree: string;
+    }) => CodingPermissions;
     provider?: () => CodingProvider;
     admissionPaused?: () => boolean;
     authorize?: (actor: CodingActor, repo: string) => boolean;
@@ -92,6 +105,8 @@ export declare class CodingWorkspace {
     private putItem;
     private flush;
     private item;
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    private permissionsFor;
     private native;
     private request;
     private event;

package/dist/coding-workspace.js

@@ -278,6 +278,13 @@ export class CodingWorkspace {
         const clientId = string(item['clientId']) || string(item['clientUserMessageId']);
         return { id, type, text, status: string(item['status']) || null, ...(type === 'userMessage' && clientId ? { clientId } : {}) };
     }
+    /** The thread's confinement, made right before each start or resume from the plane's own records. */
+    permissionsFor(repo, worktree) {
+        const made = this.options.permissions({ repo, worktree });
+        if ('problem' in made)
+            throw Error(made.problem);
+        return made;
+    }
     native() {
         if (this.closed || this.closing || this.persistenceFailed)
             throw Error('The coding server cannot save activity. Reopen the workspace after the server recovers.');
@@ -445,7 +452,7 @@ export class CodingWorkspace {
             this.authorize(actor, repo);
             this.admit();
             nativeStartupAttempted = true;
-            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
+            const result = object(await this.request('thread/start', { cwd: worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(repo, worktree), ...(input.model ? { model: input.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (context?.text ?? ''), persistExtendedHistory: true }));
             const thread = object(result['thread']), nativeThreadId = string(thread['id']);
             if (!nativeThreadId)
                 throw Error('The agent did not return a session identity.');
@@ -494,7 +501,7 @@ export class CodingWorkspace {
         this.authorize({ name: session.owner, generation: session.generation }, session.repo);
         if (session.context)
             verifyCodingContext(session.context, session.repo, session.base);
-        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', sandbox: 'workspace-write', ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
+        const result = object(await this.request('thread/resume', { threadId: session.nativeThreadId, cwd: session.worktree, approvalPolicy: 'on-request', approvalsReviewer: 'user', ...this.permissionsFor(session.repo, session.worktree), ...(session.model ? { model: session.model } : {}), developerInstructions: CODING_INSTRUCTIONS + (session.context?.text ?? ''), persistExtendedHistory: true }));
         const thread = object(result['thread']);
         if (thread['id'] !== session.nativeThreadId)
             throw Error('The agent returned a different conversation. Continuity could not be verified.');

package/dist/contracts/console-api.d.ts

@@ -85,6 +85,7 @@ export declare const CONSOLE_FORMS: {
     readonly projectNetwork: FormContract<"hosts" | "local" | "mode" | "password" | "repo">;
     readonly projectWrites: FormContract<"password" | "repo" | "writes">;
     readonly projectCheckAccess: FormContract<"confirm-open" | "level" | "password" | "repo">;
+    readonly projectSandbox: FormContract<"mach" | "password" | "read-deny" | "repo">;
     readonly projectDelete: FormContract<"name" | "password" | "repo" | "step">;
     readonly policy: FormContract<"ceiling" | "models" | "password" | "provider" | "tools">;
     readonly approval: FormContract<"not_requester" | "password" | "paths" | "protect" | "repo">;

package/dist/contracts/console-api.js

@@ -94,6 +94,7 @@ export const CONSOLE_FORMS = {
     projectNetwork: formContract("POST /settings/project/network", ["repo", "mode", "local", "hosts", "password"]),
     projectWrites: formContract("POST /settings/project/writes", ["repo", "writes", "password"]),
     projectCheckAccess: formContract("POST /settings/project/check-access", ["repo", "level", "confirm-open", "password"]),
+    projectSandbox: formContract("POST /settings/project/sandbox", ["repo", "read-deny", "mach", "password"]),
     projectDelete: formContract("POST /settings/project/delete", ["repo", "name", "step", "password"]),
     policy: formContract("POST /settings/policy", ["password", "provider", "models", "tools", "ceiling"]),
     approval: formContract("POST /settings/approval", ["repo", "password", "protect", "paths", "not_requester"]),

package/dist/doctor.d.ts

@@ -17,6 +17,13 @@ export type DoctorReport = {
     findings: DoctorFinding[];
     unreadable: DoctorUnreadable[];
     notes: string[];
+    /** The sandbox every build runs in (sandbox-runtime.ts): Anthropic's sandbox-runtime, its version, and why it can't
+     * sandbox here (null when it can). */
+    sandbox?: {
+        engine: string;
+        version: string;
+        problem: string | null;
+    };
 };
 export type DoctorDeps = {
     platform?: NodeJS.Platform;

package/dist/doctor.js

@@ -24,6 +24,7 @@ import { envelopeJson } from "./envelope.js";
 import { run as runCommand } from "./exec.js";
 import { OWN_KEY_ENV } from "./keys.js";
 import { ALL_CREDENTIAL_ENV } from "./provider.js";
+import { SANDBOX_RUNTIME, sandboxRuntimeProblem, sandboxRuntimeWords } from "./sandbox-runtime.js";
 /** Names that say they hold a credential. */
 const CREDENTIAL_NAME = /(?:^|_)(?:API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|SECRET|SECRET_?KEY|TOKEN|AUTH_?TOKEN|PASSWORD|PASSWD|CREDENTIALS?|PAT)(?:_|$)/i;
 /** Names that only point at one: a path, a socket, an address. */
@@ -401,6 +402,8 @@ export function doctorLines(report) {
     }
     for (const note of report.notes)
         lines.push("", `Note: ${note}`);
+    if (report.sandbox !== undefined)
+        lines.push("", `Sandbox: ${sandboxRuntimeWords()}${report.sandbox.problem === null ? ", working here." : `, not available here: ${report.sandbox.problem}. Builds don't start unless an instance operator allows unconfined agents.`}`);
     if (report.checked.length > 0)
         lines.push("", "Checked:", ...report.checked.map(one => `  ${one}`));
     return lines;
@@ -418,6 +421,7 @@ export async function runDoctorCommand(argv, write, deps = {}) {
         return 2;
     }
     const report = await auditServiceEnvironment(deps);
+    report.sandbox = { engine: SANDBOX_RUNTIME.name, version: SANDBOX_RUNTIME.version, problem: sandboxRuntimeProblem() };
     if (json)
         write(envelopeJson({ command: "doctor", ...report }));
     else

package/dist/egress.d.ts

@@ -96,6 +96,8 @@ export declare function runNetworkFromValue(value: unknown): RunNetworkRecord |
 export type EgressProxy = {
     /** The proxy's address with this run's credentials, for HTTPS_PROXY and the like. */
     url: string;
+    /** This run's credential alone: a client presenting it (with any user name: the sandbox runtime names its own) is served. */
+    secret: string;
     port: number;
     counts: () => EgressCounts;
     close: () => Promise<void>;

package/dist/egress.js

@@ -6,8 +6,8 @@
  * and the project's added hosts), and that snapshot is what the approval binds and the launch enforces. Nothing at
  * launch re-derives it from settings changed since or from files the agent wrote.
  *
- * The launch enforces it at the operating system (agent-fence.ts: Seatbelt's network rules on macOS, a network
- * namespace on Linux) and reaches the world through one proxy of its own (startEgressProxy), which admits only the
+ * The launch enforces it at the operating system (Anthropic's sandbox-runtime: its Seatbelt network rules on macOS, a
+ * network namespace on Linux with the proxy relayed in) and reaches the world through one proxy of its own (startEgressProxy), which admits only the
  * snapshot's hosts. The proxy never decrypts TLS: it restricts where a build connects, not what it sends there.
  */
 import { createServer, request as httpRequest } from "node:http";
@@ -272,7 +272,7 @@ export async function startEgressProxy(options) {
     const upstreamPort = options.upstreamPort ?? ((port) => port);
     const lookup = options.lookup ?? (async (host) => (await dnsLookup(host, { all: true, verbatim: true })).map(one => one.address));
     const secret = randomBytes(24).toString("base64url");
-    const expected = Buffer.from(`Basic ${Buffer.from(`run:${secret}`).toString("base64")}`);
+    const expected = Buffer.from(secret);
     const sockets = new Set();
     const byHost = new Map();
     let connections = 0, refused = 0, otherHosts = 0;
@@ -300,8 +300,16 @@ export async function startEgressProxy(options) {
         }
         catch { /* a listener's trouble is not the build's */ }
     };
+    /** Basic credentials whose password is this run's secret, whatever the user name (the sandbox runtime puts its own
+     * attribution there). */
     const authorized = (incoming) => {
-        const given = Buffer.from(String(incoming.headers["proxy-authorization"] ?? ""));
+        const header = String(incoming.headers["proxy-authorization"] ?? "");
+        const basic = /^Basic ([A-Za-z0-9+/=]+)$/.exec(header)?.[1];
+        if (basic === undefined)
+            return false;
+        const decoded = Buffer.from(basic, "base64").toString("utf8");
+        const colon = decoded.indexOf(":");
+        const given = Buffer.from(colon < 0 ? "" : decoded.slice(colon + 1));
         return given.length === expected.length && timingSafeEqual(given, expected);
     };
     /** The addresses a request may reach, or why it may not. */
@@ -412,6 +420,7 @@ export async function startEgressProxy(options) {
     const port = typeof address === "object" && address !== null ? address.port : 0;
     return {
         url: `http://run:${secret}@127.0.0.1:${port}`,
+        secret,
         port,
         counts: () => ({ connections, refused, hosts: [...byHost].map(([host, one]) => ({ host, ...one })).sort((a, b) => b.connections + b.refused - (a.connections + a.refused) || a.host.localeCompare(b.host)), otherHosts }),
         close: () => new Promise(done => {

package/dist/exec.d.ts

@@ -183,18 +183,24 @@ export declare class ContainmentRefusal extends Error {
     readonly name = "ContainmentRefusal";
 }
 /**
- * The command as it runs inside the agent fence (sandbox-exec or bubblewrap wrapping it), or as it is when it has no
- * fence. A spawn whose confinement is required and that no backend here can wrap is refused (ContainmentRefusal):
- * nothing runs, and nothing falls back to running it unwrapped.
+ * The command as it runs inside the agent fence (Anthropic's sandbox-runtime wrapping it: agent-fence.ts
+ * sandboxedSpawn), with the environment that needs beside the caller's, or as it is when it has no fence. A spawn whose
+ * confinement is required and that no sandbox here can wrap is refused (ContainmentRefusal): nothing runs, and nothing
+ * falls back to running it unwrapped.
  */
 export declare function confined(file: string, args: readonly string[], bag: {
     fence?: readonly string[] | undefined;
     fenceGrants?: FenceGrants | undefined;
     confinement?: "required" | undefined;
+    cwd?: string | undefined;
+    temp?: string | undefined;
 }): {
     file: string;
     args: string[];
+    env: Record<string, string>;
 };
+/** A spawn's environment with what its sandbox needs added (nothing added: the caller's, as it was). */
+export declare function withSandboxEnv<T extends Record<string, string | undefined>>(env: T | undefined, added: Record<string, string>): T | Record<string, string | undefined> | undefined;
 /** Run IDs are local to a database. Connections to the same file share
  * custody; separate files and separate in-memory databases never do. */
 export declare function runOwnerTag(store: Store, runId: number): string;
@@ -298,6 +304,14 @@ export type AcpControl = {
         group: number;
     }[] | null;
 };
+/**
+ * Whether a listed process is the agent's launch (`names`): by its listed name, or on Linux by the program it runs,
+ * since a listing there shows the main thread's name, which Node 24 sets to "MainThread".
+ */
+export declare function agentNamed(row: {
+    pid: number;
+    name: string;
+}, names: readonly string[], programOf?: (pid: number) => string | null): boolean;
 /** How long each shutdown step waits: session/close's answer, then exit after stdin closes, then exit after SIGTERM. */
 export declare const ACP_SHUTDOWN_MS: {
     readonly close: 2000;