toolroll 0.9.70 → 0.9.71

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.9.71 — 2026-10-25
+
+- **Sandboxed launches can open a terminal of their own on macOS.** A check
+  or build that drives a pseudo-terminal (node-pty, `script`, a test that
+  runs a shell) now works inside the sandbox. Only terminals the sandboxed
+  process made itself open: Toolroll doesn't turn on the sandbox runtime's
+  `allowPty`, which also opens your other open terminals, and it now denies
+  reading those by name, which the runtime's baseline allowed. Nothing
+  sandboxed can type into a terminal, and every sandboxed launch starts in a
+  session of its own, so a console started from your terminal doesn't hand
+  it that terminal.
+- **Only a build's agent reaches your keychain.** The sandbox runtime lets
+  every sandboxed process ask macOS's keychain service, so it could read
+  keychain items any program may read (anthropics/sandbox-runtime#755). A
+  build's setup and check commands, a project's checks, flows and tool
+  servers are now denied it. A build's agent keeps it (Claude Code signs in
+  from the keychain), and so does a check whose project gave it
+  **sign-ins**, while the instance operator who chose that still is one. The
+  sign-ins choice now says it includes Keychain access.
+
 ## 0.9.70 — 2026-10-24
 
 - **Every sandbox is now Anthropic's sandbox-runtime.** Builds, their setup

package/dist/agent-fence.d.ts

@@ -92,6 +92,10 @@ export type FenceGrants = {
     homeNames?: string[];
     /** macOS: the project's sealed mach services beyond the runtime's baseline (its `allowMachLookup`). */
     machLookup?: string[];
+    /** macOS: the keychain's services (securityd), denied to every launch without it (sandbox-runtime.ts
+     * SEATBELT_NO_KEYCHAIN). Only fenceFor gives it, to a build's agent; a check with sign-ins is given it at its launch
+     * (invoke.ts). Never a tool server's (serverGrantsOf). */
+    keychain?: true;
     /** A `sign-ins` check's exact sign-in files, read again inside the home denies (check-access.ts, signInGrants). */
     signIns?: SignInGrants;
     /** Never written, wherever the launch writes (homeWriteDenies): what runs for the operator next or signs them in. */

package/dist/agent-fence.js

@@ -11,7 +11,9 @@
  * Toolroll passes it (srtTermsOf): Toolroll's own state and database denied to read and write; the build's own
  * checkout writable; other tasks' checkouts read, never written; the project's read-deny list; under policy v1 (an
  * approval sealed before 0.9.70) the home configuration denied by name; a sign-ins check's exact files read again; the
- * run's proxy as its only way out when its network is confined.
+ * run's proxy as its only way out when its network is confined. On macOS every launch also gets a pseudo-terminal of its
+ * own and no other terminal, and only a build's agent (and a check with sign-ins) reaches the keychain
+ * (sandbox-runtime.ts seatbeltRulesFor, static rules).
  *
  * Codex (every platform) fences its own agent's commands with its own sandbox: a permission profile with the same
  * denies (codexFenceArgv). Claude also gets Read/Edit deny rules for its own file tools.
@@ -983,6 +985,7 @@ export function srtTermsOf(fence, grants = NO_GRANTS) {
         readConfig,
         writeConfig: { allowOnly: [...new Set(allowOnly)].sort(), denyWithinAllow: [...denyWrite].sort() },
         allowMachLookup: [...grants.machLookup ?? [], ...grants.signIns?.mach ?? []],
+        ...(grants.keychain === true ? { keychain: true } : {}),
         network: network === undefined || network.mode === "open" ? { kind: "open" } : {
             kind: "proxy", httpPort: network.proxyPort, ...(network.brokerPorts[0] === undefined ? {} : { socksPort: network.brokerPorts[0] }),
             ...(network.token === undefined ? {} : { token: network.token }), localServices: network.loopback === "any", unixSockets: [...network.socketRoots],
@@ -1085,6 +1088,8 @@ export function fenceFor(kind, ctx) {
         ...(written === null ? {} : { writes: written.writes, readOnly: [...new Set([...made.readOnly, ...written.readOnly])].sort() }),
         ...(ctx.network === undefined ? {} : { network: ctx.network }),
         ...(ctx.machLookup === undefined || ctx.machLookup.length === 0 ? {} : { machLookup: [...ctx.machLookup] }),
+        // A build's agent signs in from the keychain (Claude Code does); nothing else it launches reaches it.
+        ...(kind === "build" ? { keychain: true } : {}),
         // Under a write allowlist these are out of reach already; where the launch writes anywhere, they are denied by name.
         writeDenies: homeWriteDenies(ctx.home ?? homedir(), ctx.binding, ctx.provider ?? null),
         ...(made.pool === undefined ? {} : { pool: { ...made.pool, ...(ctx.policy === 2 ? { readable: true } : {}),
@@ -1227,7 +1232,7 @@ export function homeWriteDenies(home, binding, provider, platform = process.plat
  * where it always has), and never the build's own checkout or launch folder read back (nothing a build wrote loads in a
  * process that holds a tool's secrets). */
 export function serverGrantsOf(grants) {
-    const { network: _agentOnly, writes: _agentWrites, ...rest } = grants;
+    const { network: _agentOnly, writes: _agentWrites, keychain: _agentKeychain, ...rest } = grants;
     return {
         ...rest,
         ...(rest.pool === undefined ? {} : { pool: { ...rest.pool, own: null } }),

package/dist/check-access.js

@@ -17,11 +17,11 @@ export const widerThan = (a, b) => RANK[a] > RANK[b];
 export const narrowestAccess = (levels) => levels.reduce((low, one) => RANK[one] < RANK[low] ? one : low, levels.length === 0 ? CHECK_ACCESS_DEFAULT : "unsandboxed");
 /** The level as a person reads it, in a sentence's middle ("Checks: …"). */
 export function checkAccessWords(level) {
-    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins" : "not sandboxed";
+    return level === "sandboxed" ? "sandboxed" : level === "sign-ins" ? "sandboxed, with model and GitHub sign-ins and, on a Mac, Keychain access" : "not sandboxed";
 }
 /** What each wider level means, said before anyone chooses it. */
 export const CHECK_ACCESS_WARNINGS = {
-    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
+    "sign-ins": "This project's checks can read your Claude, Codex and GitHub sign-ins, even where the project hides your home folder's files from builds. On a Mac that includes Keychain access: they can read any keychain item that lets every program read it, not only those sign-ins. Its tests could use or send those credentials anywhere its network setting allows. Only choose this for projects you trust.",
     unsandboxed: "This project's checks get your full access to this machine and to Toolroll itself, including its database and every sign-in. Only for a project whose checks must create sandboxes themselves, such as Toolroll's own.",
 };
 /** The services whose sign-ins a `sign-ins` check reads: Claude's and Codex's own hosts (egress.ts), and GitHub's. */

package/dist/invoke.d.ts

@@ -135,6 +135,13 @@ export declare function fencedCheckoutCommands(store: Store, repo: string, check
  * under: open, or its allowlist through a proxy of its own (on Linux, relayed in by the sandbox runtime). Nothing about it is
  * started unless all of it is.
  */
+/**
+ * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
+ * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
+ * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
+ * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ */
+export declare function signInsKeychain(store: Store, repo: string | null): boolean;
 export declare function signInsLaunch(store: Store, own: string, temp: string, checkout: string, policy: NetworkProfile, gitPaths: readonly string[], platform?: NodeJS.Platform): Promise<{
     grants: SignInGrants;
     network: NetworkFence;

package/dist/invoke.js

@@ -1017,7 +1017,9 @@ export function fencedCommands(store, runId, writes, inner, available = () => ma
                     ...options,
                     fence: fenced.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
+                        ...(signInsKeychain(store, checkout === null ? null : store.getWorktree(checkout)?.repo ?? null) ? { keychain: true } : {}) },
                     confinement: "required",
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(fenced.cache === undefined || fenced.grants.writes === undefined ? {} : buildCacheEnv(fenced.cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1086,7 +1088,9 @@ export function fencedCheckoutCommands(store, repo, checkout, inner, available =
                     ...options,
                     fence: launch.fence,
                     // Each sign-in file looked at again right before the launch: one no longer itself isn't granted.
-                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network },
+                    // With sign-ins, the keychain too (Claude Code keeps its macOS sign-in there), only while a person still set it.
+                    fenceGrants: signIns === null ? grants : { ...grants, signIns: { ...signIns.grants, read: signIns.grants.read.filter(path => signInIsItself(realpathSync(homedir()), path)) }, network: signIns.network,
+                        ...(signInsKeychain(store, repo) ? { keychain: true } : {}) },
                     confinement: launch.confinement,
                     env: { ...(options?.env ?? {}), TMPDIR: temp, TMP: temp, TEMP: temp, ...(allowed === null ? {} : buildCacheEnv(cache)), ...(signIns?.env ?? {}) },
                     ...(signIns === null ? {} : { omitEnv: [...(options?.omitEnv ?? []), ...SIGN_INS_OMITTED_ENV] }),
@@ -1173,6 +1177,19 @@ const SIGN_INS_OMITTED_ENV = ["CLAUDE_CONFIG_DIR"];
  * under: open, or its allowlist through a proxy of its own (on Linux, relayed in by the sandbox runtime). Nothing about it is
  * started unless all of it is.
  */
+/**
+ * Whether a check with sign-ins also reaches the keychain (macOS securityd: any item every program may read, not only
+ * the sign-ins). Only while the project's sign-ins level stands as a person set it: widening to sign-ins takes an
+ * instance operator's password typed now (operate.ts project check-access, Settings → Project → Check access), and the
+ * one who set it must still be an approver for the project and an instance operator now. Anything else: no keychain.
+ */
+export function signInsKeychain(store, repo) {
+    if (repo === null || store.projectCheckAccess(repo) !== "sign-ins")
+        return false;
+    const change = store.projectCheckAccessChange(repo);
+    const account = change === null ? null : store.accountOf(change.by);
+    return account !== null && account.revokedAt === null && account.role === "approver" && store.accountCanAccess(change.by, repo) && store.isInstanceOperator(change.by);
+}
 export async function signInsLaunch(store, own, temp, checkout, policy, gitPaths, platform = process.platform) {
     if (!signInsAvailable(platform))
         return { problem: "Sign-ins can't be shared with checks here, so nothing ran." };

package/dist/project-delete-ui.js

@@ -96,7 +96,7 @@ function checkAccessHtml(view) {
     const setting = unavailable !== null && saved === "sign-ins" ? "sandboxed" : saved;
     const network = view.network?.setting ?? null;
     const names = { sandboxed: "Sandboxed", "sign-ins": "Sandboxed, with model and GitHub sign-ins", unsandboxed: "Not sandboxed" };
-    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins.", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
+    const meaning = { sandboxed: null, "sign-ins": "Checks can read your Claude, Codex and GitHub sign-ins, and on a Mac your Keychain (any item every program may read).", unsandboxed: "Checks run with your full access to this machine and to Toolroll." };
     // The sign-ins never widen the network: how many hosts they'd still need, and where to add them (a change of its own).
     const missing = setting === "sign-ins" && network !== null ? signInHostsMissing(network) : [];
     const hosts = missing.length === 0 ? "" : html `<p class="meta" data-sign-in-hosts>${missing.length} sign-in ${missing.length === 1 ? "host isn't" : "hosts aren't"} allowed yet · <a href="#network">Add them</a></p><details class="hosts"><summary>Show hosts</summary><p class="tool-name">${missing.join(", ")}</p></details>`;

package/dist/sandbox-runtime.d.ts

@@ -15,6 +15,9 @@ export type SrtTerms = {
     readConfig: FsReadRestrictionConfig;
     writeConfig: FsWriteRestrictionConfig;
     allowMachLookup: string[];
+    /** macOS: the launch may reach the keychain's services (securityd). Only a build's agent and a check with sign-ins:
+     * every other launch is denied them (SEATBELT_NO_KEYCHAIN). */
+    keychain?: boolean;
     network: {
         kind: "open";
     } | {
@@ -38,8 +41,51 @@ export declare function shellQuote(words: readonly string[]): string;
  * the launch's own temp folder when it has one, so it keeps it; otherwise /tmp/claude, made if missing.
  */
 export declare function withRuntimeTemp<T>(temp: string | undefined, make: () => T): T;
+/**
+ * Toolroll's own Seatbelt rules, appended to the end of the runtime's profile (Seatbelt takes the last rule that
+ * matches). Static: constants here, never made from a launch's data.
+ *
+ * Terminals: a pseudo-terminal of the launch's own (node-pty, `script`, a test that drives a shell), and no other. The
+ * runtime's `allowPty` opens reads and writes on every /dev/ttys device, the operator's own open terminals among them,
+ * and its baseline already reads them (a read steals what is typed there). macOS marks a terminal the sandboxed process
+ * made with the `com.apple.sandbox.pty` extension (for that terminal only: a device number used again later outside is
+ * not covered), so only those are opened by name. A terminal handed down open (a live terminal's own) stays usable.
+ */
+export declare const SEATBELT_PTY: string;
+/** Last in every profile: no other terminal opened by name, and no keystrokes pushed into any terminal (TIOCSTI,
+ * _IOW('t', 114, char)), its own controlling terminal included. */
+export declare const SEATBELT_NO_OTHER_TERMINAL: string;
+/**
+ * Last in every launch's profile but a build agent's and a check with sign-ins: the keychain's services. The runtime's
+ * baseline lets every sandboxed process ask securityd, so it reads the login keychain's items whose access list lets
+ * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
+ */
+export declare const SEATBELT_NO_KEYCHAIN: string;
+/** Toolroll's rules for a launch's terms, in order: its own terminal (unless its read denies cover the devices), then
+ * the denies that must come last. */
+export declare function seatbeltRulesFor(terms: SrtTerms): string;
+/** The runtime's own quoting (its utils/shell-quote.js): a word bare when nothing in it is special, otherwise in single
+ * quotes with a quote inside as '"'"'. */
+export declare function srtQuote(words: readonly string[]): string;
+/** The words of a line srtQuote made, or null for any other line (an operator, a second command, other quoting). */
+export declare function srtWords(line: string): string[] | null;
+/**
+ * `command` (the runtime's macOS invocation) with `rules` appended to its profile, made again from its words. The
+ * runtime's invocation is exactly `env [-u NAME]… [NAME=value]… /usr/bin/sandbox-exec -p <profile> <shell> -c
+ * <command>`, each word quoted its way, and `<command>` is `expected` when given. Any other line (an operator, a word
+ * before `env` or after the command, another program) is refused, so the launch doesn't run.
+ */
+export declare function withSeatbeltRules(command: string, rules: string, expected?: string): string;
 /** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
 export declare function srtMacosCommand(file: string, args: readonly string[], terms: SrtTerms, cwd?: string, temp?: string): string;
+/**
+ * macOS: what every sandboxed launch runs first, outside the sandbox, before it execs the runtime's command: a session of
+ * its own (setsid, syscall 147), so no terminal of whoever started Toolroll is its controlling terminal to reach. A
+ * launch that is a session leader already (a live terminal's program, its own terminal made for it) keeps that one; any
+ * other that still has a controlling terminal (getsid, syscall 310) is refused. Perl with -t reads neither PERL5OPT nor
+ * PERL5LIB, and -X keeps its taint warnings off the launch's output.
+ */
+export declare const DETACH: readonly string[];
 /** The Linux helper (sandbox-launch.ts) and the environment variable its launch is handed in. */
 export declare const SANDBOX_LAUNCH_SPEC = "TOOLROLL_SANDBOX_LAUNCH";
 export declare const sandboxLaunchHelper: () => string;
@@ -52,7 +98,8 @@ export type SandboxLaunchSpec = {
     temp?: string;
 };
 /**
- * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>`; on Linux the helper,
+ * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>` in a session of its own
+ * (DETACH); on Linux the helper,
  * handed the launch in its environment (never its arguments, which other users can list).
  */
 export declare function srtSpawn(file: string, args: readonly string[], terms: SrtTerms, cwd?: string, temp?: string, platform?: NodeJS.Platform): {

package/dist/sandbox-runtime.js

@@ -2,8 +2,10 @@
  * The sandbox engine: Anthropic's sandbox-runtime (`@anthropic-ai/sandbox-runtime`, pinned in package.json). Every
  * macOS Seatbelt profile and every Linux bubblewrap + seccomp invocation a fenced launch runs under is generated by
  * its own code, per launch, from a small static config (read denies with exact re-allows, write roots with denies
- * inside them, mach services, the run's proxy). Toolroll adds only what that config says (agent-fence.ts srtTermsOf);
- * the rules themselves, their baseline and their limits are the sandbox runtime's.
+ * inside them, mach services, the run's proxy). Toolroll adds only what that config says (agent-fence.ts srtTermsOf),
+ * plus, on macOS, a few static rules of its own appended to the end of the profile (seatbeltRulesFor: a terminal of the
+ * launch's own and no other, no keystrokes pushed into a terminal, the keychain's services only for builds); the rest
+ * of the rules, their baseline and their limits are the runtime's.
  *
  * macOS: its profile builder runs in this process (it is synchronous), with this process's working folder set to the
  * launch's for the call, because the runtime anchors its mandatory write denies (.git/hooks, .vscode, shell profiles)
@@ -90,6 +92,133 @@ export function withRuntimeTemp(temp, make) {
             process.env["CLAUDE_TMPDIR"] = before.old;
     }
 }
+/**
+ * Toolroll's own Seatbelt rules, appended to the end of the runtime's profile (Seatbelt takes the last rule that
+ * matches). Static: constants here, never made from a launch's data.
+ *
+ * Terminals: a pseudo-terminal of the launch's own (node-pty, `script`, a test that drives a shell), and no other. The
+ * runtime's `allowPty` opens reads and writes on every /dev/ttys device, the operator's own open terminals among them,
+ * and its baseline already reads them (a read steals what is typed there). macOS marks a terminal the sandboxed process
+ * made with the `com.apple.sandbox.pty` extension (for that terminal only: a device number used again later outside is
+ * not covered), so only those are opened by name. A terminal handed down open (a live terminal's own) stays usable.
+ */
+export const SEATBELT_PTY = [
+    "; Toolroll: a pseudo-terminal the launch made itself",
+    "(allow pseudo-tty)",
+    "(allow file-read* file-write* file-ioctl (literal \"/dev/ptmx\"))",
+    "(allow file-read* file-write* file-ioctl (require-all (regex #\"^/dev/ttys[0-9]+$\") (extension \"com.apple.sandbox.pty\")))",
+].join("\n");
+/** Last in every profile: no other terminal opened by name, and no keystrokes pushed into any terminal (TIOCSTI,
+ * _IOW('t', 114, char)), its own controlling terminal included. */
+export const SEATBELT_NO_OTHER_TERMINAL = [
+    "; Toolroll: no other terminal, and nothing typed into one",
+    "(deny file-read-data file-write* (require-all (regex #\"^/dev/ttys[0-9]+$\") (require-not (extension \"com.apple.sandbox.pty\"))))",
+    "(deny file-ioctl (ioctl-command 2147578994))",
+].join("\n");
+/**
+ * Last in every launch's profile but a build agent's and a check with sign-ins: the keychain's services. The runtime's
+ * baseline lets every sandboxed process ask securityd, so it reads the login keychain's items whose access list lets
+ * any program read them (anthropics/sandbox-runtime#755). Build agents keep it (Claude Code signs in from the keychain).
+ */
+export const SEATBELT_NO_KEYCHAIN = [
+    "; Toolroll: no keychain",
+    "(deny mach-lookup (global-name \"com.apple.SecurityServer\") (global-name \"com.apple.securityd.xpc\"))",
+].join("\n");
+/** Whether a read deny covers the launch's own terminal devices (/dev/ptmx, /dev/ttys*): then it gets none. */
+function deniesTerminals(deny) {
+    const glob = deny.search(/[*?[]/);
+    const path = (glob < 0 ? deny : deny.slice(0, glob)).replace(/\/+$/, "");
+    const devices = ["/dev/ptmx", "/dev/ttys0"];
+    if (glob >= 0)
+        return devices.some(device => device.startsWith(path));
+    return path === "" || path === "/dev" || devices.includes(path) || /^\/dev\/ttys[0-9]*$/.test(path);
+}
+/** Toolroll's rules for a launch's terms, in order: its own terminal (unless its read denies cover the devices), then
+ * the denies that must come last. */
+export function seatbeltRulesFor(terms) {
+    const denied = [...terms.readConfig.denyOnly, ...terms.readConfig.literalDenyOnly ?? []].some(one => deniesTerminals(typeof one === "string" ? one : String(one)));
+    return [...denied ? [] : [SEATBELT_PTY], SEATBELT_NO_OTHER_TERMINAL, ...terms.keychain === true ? [] : [SEATBELT_NO_KEYCHAIN]].join("\n");
+}
+const BARE_WORD = /^[A-Za-z0-9_./:@+,-][A-Za-z0-9_./:=@+,-]*$/;
+/** The runtime's own quoting (its utils/shell-quote.js): a word bare when nothing in it is special, otherwise in single
+ * quotes with a quote inside as '"'"'. */
+export function srtQuote(words) {
+    return words.map(word => word === "" ? "''" : BARE_WORD.test(word) ? word : `'${word.replace(/'/g, `'"'"'`)}'`).join(" ");
+}
+/** The words of a line srtQuote made, or null for any other line (an operator, a second command, other quoting). */
+export function srtWords(line) {
+    const words = [];
+    let at = 0;
+    while (at < line.length) {
+        let word = "";
+        if (line[at] === "'") {
+            for (;;) {
+                const close = line.indexOf("'", at + 1);
+                if (close < 0)
+                    return null;
+                word += line.slice(at + 1, close);
+                at = close + 1;
+                if (line.startsWith(`"'"'`, at)) {
+                    word += "'";
+                    at += 3;
+                    continue;
+                }
+                break;
+            }
+        }
+        else {
+            const end = line.indexOf(" ", at);
+            word = line.slice(at, end < 0 ? line.length : end);
+            if (!BARE_WORD.test(word))
+                return null;
+            at += word.length;
+        }
+        words.push(word);
+        if (at === line.length)
+            break;
+        if (line[at] !== " " || at + 1 === line.length)
+            return null;
+        at += 1;
+    }
+    return words.length > 0 && srtQuote(words) === line ? words : null;
+}
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/**
+ * `command` (the runtime's macOS invocation) with `rules` appended to its profile, made again from its words. The
+ * runtime's invocation is exactly `env [-u NAME]… [NAME=value]… /usr/bin/sandbox-exec -p <profile> <shell> -c
+ * <command>`, each word quoted its way, and `<command>` is `expected` when given. Any other line (an operator, a word
+ * before `env` or after the command, another program) is refused, so the launch doesn't run.
+ */
+export function withSeatbeltRules(command, rules, expected) {
+    if (rules.includes("'"))
+        throw new Error("a Seatbelt rule Toolroll adds can't hold a quote");
+    const shape = () => new Error("the sandbox runtime's command isn't the shape Toolroll knows");
+    const words = srtWords(command);
+    if (words === null || words[0] !== "env")
+        throw shape();
+    const exec = words.indexOf(SANDBOX_EXEC);
+    if (exec < 1 || words.length !== exec + 6 || words[exec + 1] !== "-p" || words[exec + 4] !== "-c")
+        throw shape();
+    for (let index = 1; index < exec; index += 1) {
+        if (words[index] === "-u") {
+            if (!ENV_NAME.test(words[index + 1] ?? ""))
+                throw shape();
+            index += 1;
+            continue;
+        }
+        const name = words[index].split("=", 1)[0];
+        if (!words[index].includes("=") || !ENV_NAME.test(name))
+            throw shape();
+    }
+    const profile = words[exec + 2];
+    if (!profile.startsWith("(version 1)\n(deny default"))
+        throw shape();
+    if (!/^\/[A-Za-z0-9_./-]+$/.test(words[exec + 3]))
+        throw shape();
+    if (expected !== undefined && words[exec + 5] !== expected)
+        throw shape();
+    return srtQuote([...words.slice(0, exec + 2), `${profile}\n${rules}\n`, ...words.slice(exec + 3)]);
+}
 /** The runtime's macOS invocation for `file args` run from `cwd`: a command line for /bin/sh. */
 export function srtMacosCommand(file, args, terms, cwd = process.cwd(), temp) {
     const network = terms.network;
@@ -110,13 +239,24 @@ export function srtMacosCommand(file, args, terms, cwd = process.cwd(), temp) {
     // The runtime anchors its mandatory write denies at this process's working folder: the launch's, for this call.
     const before = process.cwd();
     process.chdir(cwd);
+    let command;
     try {
-        return withRuntimeTemp(temp, () => wrapCommandWithSandboxMacOS(params));
+        command = withRuntimeTemp(temp, () => wrapCommandWithSandboxMacOS(params));
     }
     finally {
         process.chdir(before);
     }
+    return withSeatbeltRules(command, seatbeltRulesFor(terms), params.command);
 }
+/**
+ * macOS: what every sandboxed launch runs first, outside the sandbox, before it execs the runtime's command: a session of
+ * its own (setsid, syscall 147), so no terminal of whoever started Toolroll is its controlling terminal to reach. A
+ * launch that is a session leader already (a live terminal's program, its own terminal made for it) keeps that one; any
+ * other that still has a controlling terminal (getsid, syscall 310) is refused. Perl with -t reads neither PERL5OPT nor
+ * PERL5LIB, and -X keeps its taint warnings off the launch's output.
+ */
+export const DETACH = ["-t", "-X", "-e",
+    'syscall(147) != -1 or syscall(310, 0) == $$ or !open(my $t, "<", "/dev/tty") or die "toolroll: the sandboxed launch kept a terminal\\n"; exec { $ARGV[0] } @ARGV; die "toolroll: the sandbox could not start: $!\\n";'];
 /** The Linux helper (sandbox-launch.ts) and the environment variable its launch is handed in. */
 export const SANDBOX_LAUNCH_SPEC = "TOOLROLL_SANDBOX_LAUNCH";
 export const sandboxLaunchHelper = () => {
@@ -125,7 +265,8 @@ export const sandboxLaunchHelper = () => {
     return existsSync(beside) ? beside : fileURLToPath(new URL("../dist/sandbox-launch.js", import.meta.url));
 };
 /**
- * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>`; on Linux the helper,
+ * `file args` inside the runtime's sandbox, as a spawn: on macOS `/bin/sh -c <its command>` in a session of its own
+ * (DETACH); on Linux the helper,
  * handed the launch in its environment (never its arguments, which other users can list).
  */
 export function srtSpawn(file, args, terms, cwd = process.cwd(), temp, platform = process.platform) {
@@ -133,7 +274,7 @@ export function srtSpawn(file, args, terms, cwd = process.cwd(), temp, platform
         const command = srtMacosCommand(file, args, terms, cwd, temp);
         if (!command.includes(SANDBOX_EXEC))
             throw new Error("the sandbox runtime returned the command unsandboxed");
-        return { file: "/bin/sh", args: ["-c", command], env: {} };
+        return { file: "/usr/bin/perl", args: [...DETACH, "/bin/sh", "-c", command], env: {} };
     }
     const spec = { file, args: [...args], cwd, terms, ...(temp === undefined ? {} : { temp }) };
     return { file: process.execPath, args: [sandboxLaunchHelper()], env: { [SANDBOX_LAUNCH_SPEC]: JSON.stringify(spec) } };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toolroll",
-  "version": "0.9.70",
+  "version": "0.9.71",
   "description": "A control plane for unattended coding agents — queue tasks, walk away, come back to pull requests. Agents build in leased worktrees, never touch your default branch, and interrupt you only for decisions that need a human.",
   "directories": {
     "doc": "docs"