toolroll 0.9.69 → 0.9.71

package/dist/sandbox-runtime.d.ts

@@ -0,0 +1,109 @@
+import type { FsReadRestrictionConfig, FsWriteRestrictionConfig } from "@anthropic-ai/sandbox-runtime";
+/** The engine and its exact version, as the console and the words say it. */
+export declare const SANDBOX_RUNTIME: {
+    name: string;
+    version: string;
+};
+/** "Anthropic's sandbox-runtime 0.0.79": how every surface names the engine. */
+export declare const sandboxRuntimeWords: () => string;
+/**
+ * One launch's sandbox, as the runtime's own config: what it may not read (and the exact paths read again inside
+ * those), where it may write (and what stays unwritable there), the extra macOS services it may look up, and its
+ * network (open, or only through this run's proxy; a tool broker rides the runtime's second relay).
+ */
+export type SrtTerms = {
+    readConfig: FsReadRestrictionConfig;
+    writeConfig: FsWriteRestrictionConfig;
+    allowMachLookup: string[];
+    /** macOS: the launch may reach the keychain's services (securityd). Only a build's agent and a check with sign-ins:
+     * every other launch is denied them (SEATBELT_NO_KEYCHAIN). */
+    keychain?: boolean;
+    network: {
+        kind: "open";
+    } | {
+        kind: "proxy";
+        httpPort: number;
+        socksPort?: number;
+        token?: string;
+        localServices: boolean;
+        unixSockets: string[];
+    };
+};
+/** A deny-by-default profile, as the runtime's are: inside another sandbox one can't be applied (an allow-by-default one
+ * still can, so it proves nothing). */
+export declare const SEATBELT_PROBE = "(version 1)(deny default)(allow process-exec)(allow process-fork)(allow file-read*)(allow sysctl-read)(allow mach-lookup)";
+/** Why the runtime can't sandbox here, or null when it can (checked before every launch; nothing runs bare). */
+export declare function sandboxRuntimeProblem(platform?: NodeJS.Platform): string | null;
+/** POSIX shell words. */
+export declare function shellQuote(words: readonly string[]): string;
+/**
+ * The runtime sets a sandboxed command's TMPDIR itself (to $CLAUDE_CODE_TMPDIR of the process asking, or /tmp/claude):
+ * the launch's own temp folder when it has one, so it keeps it; otherwise /tmp/claude, made if missing.
+ */
+export declare function withRuntimeTemp<T>(temp: string | undefined, make: () => T): T;
+/**
+ * Toolroll's own Seatbelt rules, appended to the end of the runtime's profile (Seatbelt takes the last rule that
+ * matches). Static: constants here, never made from a launch's data.
+ *
+ * Terminals: a pseudo-terminal of the launch's own (node-pty, `script`, a test that drives a shell), and no other. The
+ * runtime's `allowPty` opens reads and writes on every /dev/ttys device, the operator's own open terminals among them,
+ * and its baseline already reads them (a read steals what is typed there). macOS marks a terminal the sandboxed process
+ * made with the `com.apple.sandbox.pty` extension (for that terminal only: a device number used again later outside is
+ * not covered), so only those are opened by name. A terminal handed down open (a live terminal's own) stays usable.
+ */
+export declare const SEATBELT_PTY: string;
+/** Last in every profile: no other terminal opened by name, and no keystrokes pushed into any terminal (TIOCSTI,
+ * _IOW('t', 114, char)), its own controlling terminal included. */
+export declare const SEATBELT_NO_OTHER_TERMINAL: string;
+/**
+ * Last in every launch's profile but a build agent's and a check with sign-ins: the keychain's services. The runtime's
+ * baseline lets every sandboxed process ask securityd, so it reads the login keychain's items whose access list lets
+ * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
+ */
+export declare const SEATBELT_NO_KEYCHAIN: string;
+/** Toolroll's rules for a launch's terms, in order: its own terminal (unless its read denies cover the devices), then
+ * the denies that must come last. */
+export declare function seatbeltRulesFor(terms: SrtTerms): string;
+/** The runtime's own quoting (its utils/shell-quote.js): a word bare when nothing in it is special, otherwise in single
+ * quotes with a quote inside as '"'"'. */
+export declare function srtQuote(words: readonly string[]): string;
+/** The words of a line srtQuote made, or null for any other line (an operator, a second command, other quoting). */
+export declare function srtWords(line: string): string[] | null;
+/**
+ * `command` (the runtime's macOS invocation) with `rules` appended to its profile, made again from its words. The
+ * runtime's invocation is exactly `env [-u NAME]… [NAME=value]… /usr/bin/sandbox-exec -p <profile> <shell> -c
+ * <command>`, each word quoted its way, and `<command>` is `expected` when given. Any other line (an operator, a word
+ * before `env` or after the command, another program) is refused, so the launch doesn't run.
+ */
+export declare function withSeatbeltRules(command: string, rules: string, expected?: string): string;
+/** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
+export declare function srtMacosCommand(file: string, args: readonly string[], terms: SrtTerms, cwd?: string, temp?: string): string;
+/**
+ * macOS: what every sandboxed launch runs first, outside the sandbox, before it execs the runtime's command: a session of
+ * its own (setsid, syscall 147), so no terminal of whoever started Toolroll is its controlling terminal to reach. A
+ * launch that is a session leader already (a live terminal's program, its own terminal made for it) keeps that one; any
+ * other that still has a controlling terminal (getsid, syscall 310) is refused. Perl with -t reads neither PERL5OPT nor
+ * PERL5LIB, and -X keeps its taint warnings off the launch's output.
+ */
+export declare const DETACH: readonly string[];
+/** The Linux helper (sandbox-launch.ts) and the environment variable its launch is handed in. */
+export declare const SANDBOX_LAUNCH_SPEC = "TOOLROLL_SANDBOX_LAUNCH";
+export declare const sandboxLaunchHelper: () => string;
+/** What the Linux helper is given: the command, where it runs, and the terms. */
+export type SandboxLaunchSpec = {
+    file: string;
+    args: string[];
+    cwd: string;
+    terms: SrtTerms;
+    temp?: string;
+};
+/**
+ * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>` in a session of its own
+ * (DETACH); on Linux the helper,
+ * handed the launch in its environment (never its arguments, which other users can list).
+ */
+export declare function srtSpawn(file: string, args: readonly string[], terms: SrtTerms, cwd?: string, temp?: string, platform?: NodeJS.Platform): {
+    file: string;
+    args: string[];
+    env: Record<string, string>;
+};

package/dist/sandbox-runtime.js

@@ -0,0 +1,281 @@
+/**
+ * The sandbox engine: Anthropic's sandbox-runtime (`@anthropic-ai/sandbox-runtime`, pinned in package.json). Every
+ * macOS Seatbelt profile and every Linux bubblewrap + seccomp invocation a fenced launch runs under is generated by
+ * its own code, per launch, from a small static config (read denies with exact re-allows, write roots with denies
+ * inside them, mach services, the run's proxy). Toolroll adds only what that config says (agent-fence.ts srtTermsOf),
+ * plus, on macOS, a few static rules of its own appended to the end of the profile (seatbeltRulesFor: a terminal of the
+ * launch's own and no other, no keystrokes pushed into a terminal, the keychain's services only for builds); the rest
+ * of the rules, their baseline and their limits are the runtime's.
+ *
+ * macOS: its profile builder runs in this process (it is synchronous), with this process's working folder set to the
+ * launch's for the call, because the runtime anchors its mandatory write denies (.git/hooks, .vscode, shell profiles)
+ * at the working folder. Linux: its builder is asynchronous, anchored at the working folder too, and leaves mount
+ * points to clean up after the command, so each Linux launch runs through a small helper process
+ * (sandbox-launch.ts) that changes into the launch's folder, asks the runtime for the command, runs it and cleans up.
+ */
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { wrapCommandWithSandboxMacOS } from "@anthropic-ai/sandbox-runtime/dist/sandbox/macos-sandbox-utils.js";
+import { checkLinuxDependencies, getLinuxDependencyStatus } from "@anthropic-ai/sandbox-runtime/dist/sandbox/linux-sandbox-utils.js";
+const require = createRequire(import.meta.url);
+/** The engine and its exact version, as the console and the words say it. */
+export const SANDBOX_RUNTIME = (() => {
+    const name = "@anthropic-ai/sandbox-runtime";
+    try {
+        const manifest = JSON.parse(readFileSync(join(dirname(require.resolve(name)), "..", "package.json"), "utf8"));
+        return { name, version: typeof manifest.version === "string" ? manifest.version : "unknown" };
+    }
+    catch {
+        return { name, version: "unknown" };
+    }
+})();
+/** "Anthropic's sandbox-runtime 0.0.79": how every surface names the engine. */
+export const sandboxRuntimeWords = () => `Anthropic's sandbox-runtime ${SANDBOX_RUNTIME.version}`;
+const SANDBOX_EXEC = "/usr/bin/sandbox-exec";
+/** A deny-by-default profile, as the runtime's are: inside another sandbox one can't be applied (an allow-by-default one
+ * still can, so it proves nothing). */
+export const SEATBELT_PROBE = "(version 1)(deny default)(allow process-exec)(allow process-fork)(allow file-read*)(allow sysctl-read)(allow mach-lookup)";
+/** Why the runtime can't sandbox here, or null when it can (checked before every launch; nothing runs bare). */
+export function sandboxRuntimeProblem(platform = process.platform) {
+    if (platform === "darwin") {
+        if (!existsSync(SANDBOX_EXEC))
+            return "this Mac has no sandbox-exec";
+        const probe = spawnSync(SANDBOX_EXEC, ["-p", SEATBELT_PROBE, "/usr/bin/true"], { timeout: 5_000, stdio: "ignore" });
+        return probe.status === 0 ? null : "sandbox-exec can't start a sandbox here (is this already inside one?)";
+    }
+    if (platform === "linux") {
+        const checked = checkLinuxDependencies();
+        if (checked.errors.length > 0)
+            return checked.errors.join("; ");
+        if (!getLinuxDependencyStatus().hasSeccompApply)
+            return "the sandbox runtime's seccomp helper isn't available for this processor";
+        // The runtime finds nested protected names (a subfolder's .git/hooks, .vscode, shell profiles) with ripgrep.
+        if (spawnSync("rg", ["--version"], { timeout: 5_000, stdio: "ignore" }).status !== 0)
+            return "ripgrep (rg) is not installed";
+        const probe = spawnSync("bwrap", ["--ro-bind", "/", "/", "--unshare-pid", "--unshare-user", "--proc", "/proc", "--new-session", "--", "true"], { timeout: 5_000, stdio: "ignore" });
+        return probe.status === 0 ? null : "bubblewrap can't start a sandbox here (unprivileged user namespaces may be off)";
+    }
+    return `the sandbox runtime has no sandbox for ${platform}`;
+}
+/** POSIX shell words. */
+export function shellQuote(words) {
+    return words.map(word => /^[A-Za-z0-9_@%+=:,./-]+$/.test(word) ? word : `'${word.replace(/'/g, `'\\''`)}'`).join(" ");
+}
+/**
+ * The runtime sets a sandboxed command's TMPDIR itself (to $CLAUDE_CODE_TMPDIR of the process asking, or /tmp/claude):
+ * the launch's own temp folder when it has one, so it keeps it; otherwise /tmp/claude, made if missing.
+ */
+export function withRuntimeTemp(temp, make) {
+    const before = { code: process.env["CLAUDE_CODE_TMPDIR"], old: process.env["CLAUDE_TMPDIR"] };
+    delete process.env["CLAUDE_TMPDIR"];
+    if (temp !== undefined && temp !== "")
+        process.env["CLAUDE_CODE_TMPDIR"] = temp;
+    else {
+        delete process.env["CLAUDE_CODE_TMPDIR"];
+        try {
+            mkdirSync("/tmp/claude", { recursive: true, mode: 0o700 });
+        }
+        catch { /* someone else's: writes there fail */ }
+    }
+    try {
+        return make();
+    }
+    finally {
+        if (before.code === undefined)
+            delete process.env["CLAUDE_CODE_TMPDIR"];
+        else
+            process.env["CLAUDE_CODE_TMPDIR"] = before.code;
+        if (before.old !== undefined)
+            process.env["CLAUDE_TMPDIR"] = before.old;
+    }
+}
+/**
+ * Toolroll's own Seatbelt rules, appended to the end of the runtime's profile (Seatbelt takes the last rule that
+ * matches). Static: constants here, never made from a launch's data.
+ *
+ * Terminals: a pseudo-terminal of the launch's own (node-pty, `script`, a test that drives a shell), and no other. The
+ * runtime's `allowPty` opens reads and writes on every /dev/ttys device, the operator's own open terminals among them,
+ * and its baseline already reads them (a read steals what is typed there). macOS marks a terminal the sandboxed process
+ * made with the `com.apple.sandbox.pty` extension (for that terminal only: a device number used again later outside is
+ * not covered), so only those are opened by name. A terminal handed down open (a live terminal's own) stays usable.
+ */
+export const SEATBELT_PTY = [
+    "; Toolroll: a pseudo-terminal the launch made itself",
+    "(allow pseudo-tty)",
+    "(allow file-read* file-write* file-ioctl (literal \"/dev/ptmx\"))",
+    "(allow file-read* file-write* file-ioctl (require-all (regex #\"^/dev/ttys[0-9]+$\") (extension \"com.apple.sandbox.pty\")))",
+].join("\n");
+/** Last in every profile: no other terminal opened by name, and no keystrokes pushed into any terminal (TIOCSTI,
+ * _IOW('t', 114, char)), its own controlling terminal included. */
+export const SEATBELT_NO_OTHER_TERMINAL = [
+    "; Toolroll: no other terminal, and nothing typed into one",
+    "(deny file-read-data file-write* (require-all (regex #\"^/dev/ttys[0-9]+$\") (require-not (extension \"com.apple.sandbox.pty\"))))",
+    "(deny file-ioctl (ioctl-command 2147578994))",
+].join("\n");
+/**
+ * Last in every launch's profile but a build agent's and a check with sign-ins: the keychain's services. The runtime's
+ * baseline lets every sandboxed process ask securityd, so it reads the login keychain's items whose access list lets
+ * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
+ */
+export const SEATBELT_NO_KEYCHAIN = [
+    "; Toolroll: no keychain",
+    "(deny mach-lookup (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
+].join("\n");
+/** Whether a read deny covers the launch's own terminal devices (/dev/ptmx, /dev/ttys*): then it gets none. */
+function deniesTerminals(deny) {
+    const glob = deny.search(/[*?[]/);
+    const path = (glob < 0 ? deny : deny.slice(0, glob)).replace(/\/+$/, "");
+    const devices = ["/dev/ptmx", "/dev/ttys0"];
+    if (glob >= 0)
+        return devices.some(device => device.startsWith(path));
+    return path === "" || path === "/dev" || devices.includes(path) || /^\/dev\/ttys[0-9]*$/.test(path);
+}
+/** Toolroll's rules for a launch's terms, in order: its own terminal (unless its read denies cover the devices), then
+ * the denies that must come last. */
+export function seatbeltRulesFor(terms) {
+    const denied = [...terms.readConfig.denyOnly, ...terms.readConfig.literalDenyOnly ?? []].some(one => deniesTerminals(typeof one === "string" ? one : String(one)));
+    return [...denied ? [] : [SEATBELT_PTY], SEATBELT_NO_OTHER_TERMINAL, ...terms.keychain === true ? [] : [SEATBELT_NO_KEYCHAIN]].join("\n");
+}
+const BARE_WORD = /^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/;
+/** The runtime's own quoting (its utils/shell-quote.js): a word bare when nothing in it is special, otherwise in single
+ * quotes with a quote inside as '"'"'. */
+export function srtQuote(words) {
+    return words.map(word => word === "" ? "''" : BARE_WORD.test(word) ? word : `'${word.replace(/'/g, `'"'"'`)}'`).join(" ");
+}
+/** The words of a line srtQuote made, or null for any other line (an operator, a second command, other quoting). */
+export function srtWords(line) {
+    const words = [];
+    let at = 0;
+    while (at < line.length) {
+        let word = "";
+        if (line[at] === "'") {
+            for (;;) {
+                const close = line.indexOf("'", at + 1);
+                if (close < 0)
+                    return null;
+                word += line.slice(at + 1, close);
+                at = close + 1;
+                if (line.startsWith(`"'"'`, at)) {
+                    word += "'";
+                    at += 3;
+                    continue;
+                }
+                break;
+            }
+        }
+        else {
+            const end = line.indexOf(" ", at);
+            word = line.slice(at, end < 0 ? line.length : end);
+            if (!BARE_WORD.test(word))
+                return null;
+            at += word.length;
+        }
+        words.push(word);
+        if (at === line.length)
+            break;
+        if (line[at] !== " " || at + 1 === line.length)
+            return null;
+        at += 1;
+    }
+    return words.length > 0 && srtQuote(words) === line ? words : null;
+}
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * `command` (the runtime's macOS invocation) with `rules` appended to its profile, made again from its words. The
+ * runtime's invocation is exactly `env [-u NAME]… [NAME=value]… /usr/bin/sandbox-exec -p <profile> <shell> -c
+ * <command>`, each word quoted its way, and `<command>` is `expected` when given. Any other line (an operator, a word
+ * before `env` or after the command, another program) is refused, so the launch doesn't run.
+ */
+export function withSeatbeltRules(command, rules, expected) {
+    if (rules.includes("'"))
+        throw new Error("a Seatbelt rule Toolroll adds can't hold a quote");
+    const shape = () => new Error("the sandbox runtime's command isn't the shape Toolroll knows");
+    const words = srtWords(command);
+    if (words === null || words[0] !== "env")
+        throw shape();
+    const exec = words.indexOf(SANDBOX_EXEC);
+    if (exec < 1 || words.length !== exec + 6 || words[exec + 1] !== "-p" || words[exec + 4] !== "-c")
+        throw shape();
+    for (let index = 1; index < exec; index += 1) {
+        if (words[index] === "-u") {
+            if (!ENV_NAME.test(words[index + 1] ?? ""))
+                throw shape();
+            index += 1;
+            continue;
+        }
+        const name = words[index].split("=", 1)[0];
+        if (!words[index].includes("=") || !ENV_NAME.test(name))
+            throw shape();
+    }
+    const profile = words[exec + 2];
+    if (!profile.startsWith("(version 1)\n(deny default"))
+        throw shape();
+    if (!/^\/[A-Za-z0-9_./-]+$/.test(words[exec + 3]))
+        throw shape();
+    if (expected !== undefined && words[exec + 5] !== expected)
+        throw shape();
+    return srtQuote([...words.slice(0, exec + 2), `${profile}\n${rules}\n`, ...words.slice(exec + 3)]);
+}
+/** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
+export function srtMacosCommand(file, args, terms, cwd = process.cwd(), temp) {
+    const network = terms.network;
+    const params = {
+        command: shellQuote([file, ...args]),
+        needsNetworkRestriction: network.kind === "proxy",
+        ...(network.kind === "proxy" ? {
+            httpProxyPort: network.httpPort,
+            ...(network.socksPort === undefined ? {} : { socksProxyPort: network.socksPort }),
+            ...(network.token === undefined ? {} : { proxyAuthToken: network.token }),
+            allowLocalBinding: network.localServices,
+            ...(network.unixSockets.length === 0 ? {} : { allowUnixSockets: network.unixSockets }),
+        } : {}),
+        ...(terms.allowMachLookup.length === 0 ? {} : { allowMachLookup: terms.allowMachLookup }),
+        readConfig: terms.readConfig,
+        writeConfig: terms.writeConfig,
+    };
+    // The runtime anchors its mandatory write denies at this process's working folder: the launch's, for this call.
+    const before = process.cwd();
+    process.chdir(cwd);
+    let command;
+    try {
+        command = withRuntimeTemp(temp, () => wrapCommandWithSandboxMacOS(params));
+    }
+    finally {
+        process.chdir(before);
+    }
+    return withSeatbeltRules(command, seatbeltRulesFor(terms), params.command);
+}
+/**
+ * macOS: what every sandboxed launch runs first, outside the sandbox, before it execs the runtime's command: a session of
+ * its own (setsid, syscall 147), so no terminal of whoever started Toolroll is its controlling terminal to reach. A
+ * launch that is a session leader already (a live terminal's program, its own terminal made for it) keeps that one; any
+ * other that still has a controlling terminal (getsid, syscall 310) is refused. Perl with -t reads neither PERL5OPT nor
+ * PERL5LIB, and -X keeps its taint warnings off the launch's output.
+ */
+export const DETACH = ["-t", "-X", "-e",
+    'syscall(147) != -1 or syscall(310, 0) == $$ or !open(my $t, "<", "/dev/tty") or die "toolroll: the sandboxed launch kept a terminal\\n"; exec { $ARGV[0] } @ARGV; die "toolroll: the sandbox could not start: $!\\n";'];
+/** The Linux helper (sandbox-launch.ts) and the environment variable its launch is handed in. */
+export const SANDBOX_LAUNCH_SPEC = "TOOLROLL_SANDBOX_LAUNCH";
+export const sandboxLaunchHelper = () => {
+    const beside = fileURLToPath(new URL("./sandbox-launch.js", import.meta.url));
+    // Run from the sources (the test suite), the built helper is the package's own.
+    return existsSync(beside) ? beside : fileURLToPath(new URL("../dist/sandbox-launch.js", import.meta.url));
+};
+/**
+ * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>` in a session of its own
+ * (DETACH); on Linux the helper,
+ * handed the launch in its environment (never its arguments, which other users can list).
+ */
+export function srtSpawn(file, args, terms, cwd = process.cwd(), temp, platform = process.platform) {
+    if (platform === "darwin") {
+        const command = srtMacosCommand(file, args, terms, cwd, temp);
+        if (!command.includes(SANDBOX_EXEC))
+            throw new Error("the sandbox runtime returned the command unsandboxed");
+        return { file: "/usr/bin/perl", args: [...DETACH, "/bin/sh", "-c", command], env: {} };
+    }
+    const spec = { file, args: [...args], cwd, terms, ...(temp === undefined ? {} : { temp }) };
+    return { file: process.execPath, args: [sandboxLaunchHelper()], env: { [SANDBOX_LAUNCH_SPEC]: JSON.stringify(spec) } };
+}

package/dist/scope.d.ts

@@ -81,6 +81,13 @@ export type ClaudeProfile = {
     writes?: WritesMode;
     /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
     checkAccess?: Exclude<CheckAccess, "sandboxed">;
+    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
+     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
+    fencePolicy?: 2;
+    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
+    readDeny?: string[];
+    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
+    machLookup?: string[];
 };
 export type CodexShapedProfile = {
     provider: "codex" | "openrouter";
@@ -103,6 +110,13 @@ export type CodexShapedProfile = {
     writes?: WritesMode;
     /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
     checkAccess?: Exclude<CheckAccess, "sandboxed">;
+    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
+     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
+    fencePolicy?: 2;
+    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
+    readDeny?: string[];
+    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
+    machLookup?: string[];
 };
 export type GeminiProfile = {
     provider: "gemini";
@@ -127,6 +141,13 @@ export type GeminiProfile = {
     writes?: WritesMode;
     /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
     checkAccess?: Exclude<CheckAccess, "sandboxed">;
+    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
+     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
+    fencePolicy?: 2;
+    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
+    readDeny?: string[];
+    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
+    machLookup?: string[];
 };
 /**
  * An agent over the Agent Client Protocol (acp-agents.ts, docs/plans/acp-adapter.md).
@@ -152,6 +173,13 @@ export type AcpProfile = {
     writes?: WritesMode;
     /** How far its checks reach beyond the check fence (check-access.ts), sealed when wider than sandboxed; absent: sandboxed. */
     checkAccess?: Exclude<CheckAccess, "sandboxed">;
+    /** The fence policy it was sealed under (agent-fence.ts FencePolicy): 2 from 0.9.70 (the home folder read as in
+     * Anthropic's sandbox runtime, less `readDeny`); absent on approvals sealed before, which keep v1's home denies. */
+    fencePolicy?: 2;
+    /** What its builds and checks may not read (project-sandbox.ts), sealed when the project lists any. */
+    readDeny?: string[];
+    /** macOS services its builds may also reach (project-sandbox.ts), sealed when the project lists any. */
+    machLookup?: string[];
 };
 export type ExecutionProfile = ClaudeProfile | CodexShapedProfile | GeminiProfile | AcpProfile;
 /** Whether a profile's clock is a no-progress window (an ACP profile has both clocks; its overall one is a deadline). */

package/dist/scope.js

@@ -42,6 +42,7 @@ import { createHash, randomBytes, scryptSync, timingSafeEqual } from "node:crypt
 import { networkFromValue, networkWords } from "./egress.js";
 import { isWritesMode, writesWords } from "./writes-mode.js";
 import { checkAccessWords, isCheckAccess } from "./check-access.js";
+import { MAX_MACH_LOOKUP, MAX_READ_DENY, sandboxTermsWords, validMachLookup, validReadDeny } from "./project-sandbox.js";
 import { z } from "zod";
 import {} from "./contracts/acceptance-terms.js";
 import { parseContract } from "./contracts/contract.js";
@@ -360,9 +361,26 @@ export function profileFromJson(json) {
     if (sealedAccess !== undefined && (sealedAccess === "sandboxed" || !isCheckAccess(sealedAccess)))
         return null;
     const checkAccess = sealedAccess;
-    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }), ...(checkAccess === undefined ? {} : { checkAccess }) };
+    // Sandbox parity (v133): the policy version is exactly 2 when present; the lists, when present, are non-empty, sorted,
+    // distinct and valid (project-sandbox.ts), as only this code writes them.
+    const policy = p["fencePolicy"];
+    if (policy !== undefined && policy !== 2)
+        return null;
+    const sealedList = (key, valid, max) => {
+        const list = p[key];
+        if (list === undefined)
+            return undefined;
+        return Array.isArray(list) && list.length > 0 && list.length <= max && list.every(one => typeof one === "string" && valid(one))
+            && list.every((one, at) => at === 0 || list[at - 1] < one) ? [...list] : null;
+    };
+    const readDeny = sealedList("readDeny", validReadDeny, MAX_READ_DENY);
+    const machLookup = sealedList("machLookup", validMachLookup, MAX_MACH_LOOKUP);
+    if (readDeny === null || machLookup === null)
+        return null;
+    const withNetwork = { ...(network === undefined ? {} : { network }), ...(writes === undefined ? {} : { writes }), ...(checkAccess === undefined ? {} : { checkAccess }),
+        ...(policy === undefined ? {} : { fencePolicy: 2 }), ...(readDeny === undefined ? {} : { readDeny }), ...(machLookup === undefined ? {} : { machLookup }) };
     if (p["provider"] === "claude") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permissionArgv"], ["timeoutKind", "network", "writes", "checkAccess", "fencePolicy", "readDeny", "machLookup"]) &&
             str(p["model"]) &&
             (p["permissionArgv"] === "auto" || p["permissionArgv"] === "acceptEdits" || p["permissionArgv"] === "bypassPermissions") &&
             num(p["maxTurns"]) && num(p["repairMaxTurns"]) &&
@@ -384,7 +402,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "codex" || p["provider"] === "openrouter") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "sandboxMode"], ["timeoutKind", "network", "writes", "checkAccess", "fencePolicy", "readDeny", "machLookup"]) &&
             str(p["model"]) &&
             (p["sandboxMode"] === "workspace-write" || p["sandboxMode"] === "danger-full-access") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -406,7 +424,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (p["provider"] === "gemini") {
-        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes", "checkAccess"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "approvalArgv"], ["timeoutKind", "network", "writes", "checkAccess", "fencePolicy", "readDeny", "machLookup"]) &&
             str(p["model"]) &&
             (p["approvalArgv"] === "auto_edit" || p["approvalArgv"] === "yolo") &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -428,7 +446,7 @@ export function profileFromJson(json) {
         return null;
     }
     if (typeof p["provider"] === "string" && isAcpProvider(p["provider"])) {
-        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes", "checkAccess"]) &&
+        if (exactKeys(p, [...PROVIDER_KEYS, "permission", "idleTimeoutSeconds", "repairIdleTimeoutSeconds"], ["network", "writes", "checkAccess", "fencePolicy", "readDeny", "machLookup"]) &&
             str(p["model"]) &&
             p["permission"] === "full" &&
             p["maxTurns"] === "unsupported" && p["repairMaxTurns"] === "unsupported" &&
@@ -1278,6 +1296,8 @@ export function describeScope(scope, readiness = NO_READINESS) {
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  network      ${networkWords(scope.profile.network ?? null).replace(/^Network: /, "")}`]),
         ...(scope.profile === null || scope.profile === undefined ? [] : [`  writes       ${writesWords(scope.profile.writes)}`]),
         ...(scope.profile?.checkAccess === undefined ? [] : [`  checks       ${checkAccessWords(scope.profile.checkAccess)}`]),
+        // Its sandbox terms (project-sandbox.ts), part of what the yes agrees to: what it reads, and any widening.
+        ...(scope.profile === null || scope.profile === undefined ? [] : ((terms) => [`  reads        ${terms.reads}`, ...(terms.mach === null ? [] : [`  services     ${terms.mach}`])])(sandboxTermsWords(scope.profile))),
         `  reference    ${scope.digest}`,
         `  approved     ${describeApproval(approval)}`,
     ];

package/dist/scout-browser-lock.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The scout browser helper's pinned install (scout-browser.ts ensureScoutBrowserHelper): its manifest and lockfile,
+ * generated once with `npm install --package-lock-only --registry https://registry.npmjs.org/` for @playwright/mcp
+ * 0.0.82. `npm ci` installs exactly this tree and refuses any tarball whose sha512 differs. Changing a version here is
+ * a supply-chain change: regenerate both and review the diff.
+ */
+export declare const SCOUT_BROWSER_MANIFEST: {
+    readonly name: "toolroll-scout-browser";
+    readonly private: true;
+    readonly dependencies: {
+        readonly "@playwright/mcp": "0.0.82";
+    };
+};
+export declare const SCOUT_BROWSER_LOCK: {
+    readonly name: "toolroll-scout-browser";
+    readonly lockfileVersion: 3;
+    readonly requires: true;
+    readonly packages: {
+        readonly "": {
+            readonly name: "toolroll-scout-browser";
+            readonly dependencies: {
+                readonly "@playwright/mcp": "0.0.82";
+            };
+        };
+        readonly "node_modules/@playwright/mcp": {
+            readonly version: "0.0.82";
+            readonly resolved: "https://registry.npmjs.org/@playwright/mcp/-/mcp-0.0.82.tgz";
+            readonly integrity: "sha512-OCqftfb8H4dnqm/njbTBRk3seUvUPttOlJUxCtEzXGETYOlRH5Qt3bbXIjmZIuWAxD9RF+yg1ASrPeXvm0y5cA==";
+            readonly license: "Apache-2.0";
+            readonly dependencies: {
+                readonly playwright: "1.64.0-alpha-1789764292000";
+                readonly "playwright-core": "1.64.0-alpha-1789764292000";
+            };
+            readonly bin: {
+                readonly "playwright-mcp": "cli.js";
+            };
+            readonly engines: {
+                readonly node: ">=18";
+            };
+        };
+        readonly "node_modules/playwright": {
+            readonly version: "1.64.0-alpha-1789764292000";
+            readonly resolved: "https://registry.npmjs.org/playwright/-/playwright-1.64.0-alpha-1789764292000.tgz";
+            readonly integrity: "sha512-3Ngs4ERGdC912uW3srEDtNVey4u1wSaQ/EFcKhxMpz0by0K6nidaJgM087pLpJc1osytiVnL7ack5gvgPArPNw==";
+            readonly license: "Apache-2.0";
+            readonly dependencies: {
+                readonly "playwright-core": "1.64.0-alpha-1789764292000";
+            };
+            readonly bin: {
+                readonly playwright: "cli.js";
+            };
+            readonly engines: {
+                readonly node: ">=20";
+            };
+        };
+        readonly "node_modules/playwright-core": {
+            readonly version: "1.64.0-alpha-1789764292000";
+            readonly resolved: "https://registry.npmjs.org/playwright-core/-/playwright-core-1.64.0-alpha-1789764292000.tgz";
+            readonly integrity: "sha512-ZgRaybFv4rRy7QMGnYprEGFdNJnvapNqcaER2w96bDQA+40BWIle1el1Yh9KHD3E6XYmieMB+r+UxFTCauTGGQ==";
+            readonly license: "Apache-2.0";
+            readonly bin: {
+                readonly "playwright-core": "cli.js";
+            };
+            readonly engines: {
+                readonly node: ">=20";
+            };
+        };
+    };
+};