very-happy-cli 0.2.159 → 0.2.160

package/dist/{runOpenClaw-Qqo9j63M.cjs → runOpenClaw-B1mTxN35.cjs}

@@ -5,53 +5,52 @@ var node_child_process = require('node:child_process');
 var os = require('node:os');
 var node_fs = require('node:fs');
 var path = require('node:path');
-var index = require('./types-BbvK1Tr_.cjs');
-var AcpSessionManager = require('./AcpSessionManager-Bdv8LWXh.cjs');
-var persistence = require('./limits-BH5CV5vR.cjs');
-var index$1 = require('./index-rH3DrQ5B.cjs');
+var api = require('./api-CgundNNX.cjs');
+var AcpSessionManager = require('./AcpSessionManager-BAY1Pggx.cjs');
+var logger = require('./logger-CS0mw3fa.cjs');
+var registerKillSessionHandler = require('./registerKillSessionHandler-DZeLXWcB.cjs');
+var persistence = require('./persistence-yKTH3-5X.cjs');
+var machineMetadata = require('./machineMetadata-DyDbODYd.cjs');
+var createSessionMetadata = require('./createSessionMetadata-BJxEnM-o.cjs');
+var setupOfflineReconnection = require('./setupOfflineReconnection-ByElY60m.cjs');
+var controlClient = require('./controlClient-Bcwv3D21.cjs');
+var authRelay = require('./authRelay-BdYkC1Po.cjs');
 var WebSocket = require('ws');
 var ed = require('@noble/ed25519');
 var sha2_js = require('@noble/hashes/sha2.js');
+var configuration = require('./configuration-BSYpcPwE.cjs');
+var contentLogMetadata = require('./contentLogMetadata-ZSFk_NjQ.cjs');
 require('axios');
 require('node:events');
 require('socket.io-client');
+require('./attachmentLimits-CzVrqgLR.cjs');
 require('zod');
+require('./index-DA7yINuk.cjs');
+require('@paralleldrive/cuid2');
+require('./limits-C-a7gr04.cjs');
+require('./time-DCuTyook.cjs');
+require('./lidState-BeDfxxEX.cjs');
+require('os');
 require('child_process');
+require('./registerCommonHandlers-DskirN-_.cjs');
 require('util');
 require('fs/promises');
 require('crypto');
 require('path');
 require('cross-spawn');
-require('./terminalTitleSuggest-Dji8I0Jy.cjs');
+require('./projectPath-ChLhdOyt.cjs');
 require('url');
-require('os');
-require('@paralleldrive/cuid2');
-require('node:fs/promises');
-require('node-pty');
-require('fs');
-require('tweetnacl');
-require('node:readline');
-require('@anthropic-ai/sandbox-runtime');
-require('expo-server-sdk');
+require('./sync-DccIKZ5_.cjs');
+require('./backgroundTaskActivity-CBvUdj39.cjs');
 require('chalk');
 require('node:util');
-require('./agentGuidance-BRDN1NoZ.cjs');
-require('ink');
-require('react');
-require('@anthropic-ai/claude-agent-sdk');
-require('ps-list');
-require('tmp');
-require('open');
-require('fastify');
-require('fastify-type-provider-zod');
-require('node:module');
-require('@modelcontextprotocol/sdk/server/mcp.js');
-require('node:http');
-require('@modelcontextprotocol/sdk/server/streamableHttp.js');
-require('http');
-require('inquirer');
-require('node:url');
-require('node:readline/promises');
+require('tweetnacl');
+require('./types-CRS-srZK.cjs');
+require('node:fs/promises');
+require('./package-BwMrPwqH.cjs');
+require('./detectCLI-DR9ZaN6B.cjs');
+require('fs');
+require('./localHappyAgentAuth-D6rFhaoc.cjs');
 
 function _interopNamespaceDefault(e) {
   var n = Object.create(null);
@@ -99,11 +98,11 @@ function getOpenClawDir(homeDir) {
   return path.join(homeDir, OPENCLAW_DIR_NAME);
 }
 function ensureDir(dir) {
-  persistence.ensurePrivateDirectorySync(dir);
+  configuration.ensurePrivateDirectorySync(dir);
 }
 function readJsonFile(filePath) {
   try {
-    persistence.hardenPrivateFileSync(filePath);
+    configuration.hardenPrivateFileSync(filePath);
     return JSON.parse(node_fs.readFileSync(filePath, "utf-8"));
   } catch {
     return null;
@@ -112,21 +111,21 @@ function readJsonFile(filePath) {
 function writeJsonFile(filePath, data) {
   const dir = path.join(filePath, "..");
   ensureDir(dir);
-  persistence.writePrivateFileSync(filePath, JSON.stringify(data, null, 2));
+  configuration.writePrivateFileSync(filePath, JSON.stringify(data, null, 2));
 }
 function migrateLegacyOpenClawAuth(legacyHomeDir, happyHomeDir) {
   if (legacyHomeDir === happyHomeDir) return;
   const legacyDir = getOpenClawDir(legacyHomeDir);
   if (!node_fs.existsSync(legacyDir)) return;
-  persistence.ensurePrivateDirectorySync(legacyDir);
-  persistence.ensurePrivateDirectorySync(getOpenClawDir(happyHomeDir));
+  configuration.ensurePrivateDirectorySync(legacyDir);
+  configuration.ensurePrivateDirectorySync(getOpenClawDir(happyHomeDir));
   for (const fileName of [DEVICE_IDENTITY_FILE, DEVICE_AUTH_TOKEN_FILE]) {
     const legacyPath = path.join(legacyDir, fileName);
     if (!node_fs.existsSync(legacyPath)) continue;
-    persistence.hardenPrivateFileSync(legacyPath);
+    configuration.hardenPrivateFileSync(legacyPath);
     const nextPath = path.join(getOpenClawDir(happyHomeDir), fileName);
     if (node_fs.existsSync(nextPath)) {
-      persistence.hardenPrivateFileSync(nextPath);
+      configuration.hardenPrivateFileSync(nextPath);
       continue;
     }
     try {
@@ -368,7 +367,7 @@ class OpenClawSocket {
     try {
       this.ws = new WebSocket(url);
     } catch (err) {
-      this.options.log(`Failed to create WebSocket: ${JSON.stringify(index.errorLogMetadata(err))}`);
+      this.options.log(`Failed to create WebSocket: ${JSON.stringify(contentLogMetadata.errorLogMetadata(err))}`);
       this.updateStatus("error", "Failed to create connection");
       this.scheduleReconnect();
       return;
@@ -380,7 +379,7 @@ class OpenClawSocket {
       this.handleMessage(data.toString());
     });
     this.ws.on("error", (err) => {
-      this.options.log(`WebSocket error: ${JSON.stringify(index.errorLogMetadata(err))}`);
+      this.options.log(`WebSocket error: ${JSON.stringify(contentLogMetadata.errorLogMetadata(err))}`);
       if (this.status === "connecting") {
         this.updateStatus("error", "Connection failed");
       }
@@ -473,7 +472,7 @@ class OpenClawSocket {
       this.options.log(`Connected: ${JSON.stringify({ hasServerHost: Boolean(this.serverHost), hasMainSession: Boolean(this.mainSessionKey) })}`);
     } catch (error) {
       const errorMsg = error instanceof Error ? error.message : "";
-      this.options.log(`Connect failed: ${JSON.stringify(index.errorLogMetadata(error))}`);
+      this.options.log(`Connect failed: ${JSON.stringify(contentLogMetadata.errorLogMetadata(error))}`);
       if (errorMsg.includes("NOT_PAIRED")) {
         const match = errorMsg.match(/requestId['":\s]+([a-f0-9-]+)/i);
         this.pairingRequestId = match?.[1] ?? null;
@@ -493,7 +492,7 @@ class OpenClawSocket {
     try {
       frame = JSON.parse(data);
     } catch {
-      this.options.log(`Invalid JSON: ${JSON.stringify(index.contentLogMetadata(data))}`);
+      this.options.log(`Invalid JSON: ${JSON.stringify(contentLogMetadata.contentLogMetadata(data))}`);
       return;
     }
     if (frame.type === "res") {
@@ -824,36 +823,36 @@ function resolveGatewayConfig(opts) {
 async function runOpenClaw(opts) {
   const verbose = opts.verbose === true;
   const sessionTag = node_crypto.randomUUID();
-  index.connectionState.setBackend("openclaw");
+  api.connectionState.setBackend("openclaw");
   const gatewayConfig = resolveGatewayConfig(opts);
   const log = (msg) => {
-    persistence.logger.debug(`[openclaw] ${msg}`);
+    logger.logger.debug(`[openclaw] ${msg}`);
     if (verbose) {
       console.log(`[openclaw] ${msg}`);
     }
   };
   log("Resolved configured gateway");
-  const api = await index.ApiClient.create(opts.credentials);
+  const api$1 = await api.ApiClient.create(opts.credentials);
   const settings = await persistence.readSettings();
   if (!settings?.machineId) {
     throw new Error("No machine ID found in settings");
   }
-  await api.getOrCreateMachine({
+  await api$1.getOrCreateMachine({
     machineId: settings.machineId,
-    metadata: index$1.initialMachineMetadata
+    metadata: machineMetadata.getInitialMachineMetadata()
   });
-  const { state, metadata } = index$1.createSessionMetadata({
+  const { state, metadata } = createSessionMetadata.createSessionMetadata({
     flavor: "openclaw",
     machineId: settings.machineId,
     startedBy: opts.startedBy
   });
-  const response = await api.getOrCreateSession({ tag: sessionTag, metadata, state });
+  const response = await api$1.getOrCreateSession({ tag: sessionTag, metadata, state });
   if (response) {
     log(`Happy Session ID: ${response.id}`);
   }
   let session;
-  const { session: initialSession, reconnectionHandle } = index$1.setupOfflineReconnection({
-    api,
+  const { session: initialSession, reconnectionHandle } = setupOfflineReconnection.setupOfflineReconnection({
+    api: api$1,
     sessionTag,
     metadata,
     state,
@@ -865,19 +864,19 @@ async function runOpenClaw(opts) {
   session = initialSession;
   if (response) {
     try {
-      await persistence.notifyDaemonSessionStarted(response.id, metadata, {
-        encryptionKey: persistence.encodeBase64(response.encryptionKey),
+      await controlClient.notifyDaemonSessionStarted(response.id, metadata, {
+        encryptionKey: authRelay.encodeBase64(response.encryptionKey),
         encryptionVariant: response.encryptionVariant,
         seq: response.seq,
         metadataVersion: response.metadataVersion,
         agentStateVersion: response.agentStateVersion
       });
     } catch (error) {
-      persistence.logger.debug("[openclaw] Failed to report session to daemon:", error);
+      logger.logger.debug("[openclaw] Failed to report session to daemon:", error);
     }
   }
   const sessionManager = new AcpSessionManager.AcpSessionManager();
-  const messageQueue = new index$1.MessageQueue2(() => "");
+  const messageQueue = new registerKillSessionHandler.MessageQueue2(() => "");
   let shouldExit = false;
   let abortController = new AbortController();
   let pendingTurn = null;
@@ -906,15 +905,15 @@ async function runOpenClaw(opts) {
       session.sendSessionProtocolMessage(envelope);
     }
   };
-  migrateLegacyOpenClawAuth(os.homedir(), persistence.configuration.happyHomeDir);
+  migrateLegacyOpenClawAuth(os.homedir(), configuration.configuration.happyHomeDir);
   const backend = new OpenClawBackend({
-    homeDir: persistence.configuration.happyHomeDir,
+    homeDir: configuration.configuration.happyHomeDir,
     gatewayConfig,
     log
   });
   const onBackendMessage = (msg) => {
     if (verbose) {
-      log(`Backend message: ${JSON.stringify(index.contentLogMetadata(msg))}`);
+      log(`Backend message: ${JSON.stringify(contentLogMetadata.contentLogMetadata(msg))}`);
     }
     if (msg.type === "status" && inTurn) {
       const nextThinking = msg.status === "running";
@@ -927,7 +926,7 @@ async function runOpenClaw(opts) {
       }
     }
     if (msg.type === "status" && (msg.status === "error" || msg.status === "stopped")) {
-      log(`Backend ${msg.status}: ${JSON.stringify(index.contentLogMetadata(msg.detail))}`);
+      log(`Backend ${msg.status}: ${JSON.stringify(contentLogMetadata.contentLogMetadata(msg.detail))}`);
       shouldExit = true;
       messageQueue.close();
       clearPendingTurn(new Error(`OpenClaw backend ${msg.status}`));
@@ -954,7 +953,7 @@ async function runOpenClaw(opts) {
         await backend.cancel(sessionKey);
       }
     } catch (error) {
-      persistence.logger.debug("[openclaw] Abort failed:", index.errorLogMetadata(error));
+      logger.logger.debug("[openclaw] Abort failed:", contentLogMetadata.errorLogMetadata(error));
     }
     inTurn = false;
     thinking = false;
@@ -967,7 +966,7 @@ async function runOpenClaw(opts) {
   session.rpcHandlerManager.registerHandler("openclaw-retry-pairing", async () => {
     backend.retryConnect();
   });
-  index$1.registerKillSessionHandler(session.rpcHandlerManager, async () => {
+  registerKillSessionHandler.registerKillSessionHandler(session.rpcHandlerManager, async () => {
     shouldExit = true;
     messageQueue.close();
     clearPendingTurn(new Error("Session terminated"));
@@ -984,7 +983,7 @@ async function runOpenClaw(opts) {
         if (waitSignal.aborted) continue;
         break;
       }
-      log(`Incoming prompt: ${JSON.stringify(index.contentLogMetadata(batch.message))}`);
+      log(`Incoming prompt: ${JSON.stringify(contentLogMetadata.contentLogMetadata(batch.message))}`);
       inTurn = true;
       sendEnvelopes(sessionManager.startTurn());
       const turnEnded = waitForTurnEnd();
@@ -993,14 +992,14 @@ async function runOpenClaw(opts) {
         await turnEnded;
         sendEnvelopes(sessionManager.endTurn("completed"));
       } catch (error) {
-        log(`Turn ended: ${JSON.stringify(index.errorLogMetadata(error))}`);
+        log(`Turn ended: ${JSON.stringify(contentLogMetadata.errorLogMetadata(error))}`);
         sendEnvelopes(sessionManager.endTurn("failed"));
       }
       try {
         const usage = await backend.getUsageSnapshot();
         if (usage) session.sendAgentUsageSnapshot("openclaw", usage);
       } catch (error) {
-        persistence.logger.debug("[openclaw] Failed to report usage:", index.errorLogMetadata(error));
+        logger.logger.debug("[openclaw] Failed to report usage:", contentLogMetadata.errorLogMetadata(error));
       }
       inTurn = false;
       thinking = false;
@@ -1025,7 +1024,7 @@ async function runOpenClaw(opts) {
       await session.flush();
       await session.close();
     } catch (error) {
-      persistence.logger.debug("[openclaw] Session close failed:", error);
+      logger.logger.debug("[openclaw] Session close failed:", error);
     }
   }
 }

package/dist/{runOpenClaw-D7MlPS5n.mjs → runOpenClaw-CogSedIc.mjs}

@@ -3,53 +3,52 @@ import { execFileSync } from 'node:child_process';
 import os from 'node:os';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { i as errorLogMetadata, j as contentLogMetadata, h as connectionState, A as ApiClient } from './types-Dh-s4Lqs.mjs';
-import { A as AcpSessionManager } from './AcpSessionManager-rYtVb0kN.mjs';
-import { z as ensurePrivateDirectorySync, D as hardenPrivateFileSync, E as writePrivateFileSync, r as readSettings, v as notifyDaemonSessionStarted, w as encodeBase64, l as logger, c as configuration } from './limits-CjRj8IX5.mjs';
-import { h as initialMachineMetadata, j as createSessionMetadata, k as setupOfflineReconnection, M as MessageQueue2, v as registerKillSessionHandler } from './index-BF6WfgV5.mjs';
+import { c as connectionState, A as ApiClient } from './api-CLMUr-SX.mjs';
+import { A as AcpSessionManager } from './AcpSessionManager-CoMWFVw3.mjs';
+import { l as logger } from './logger-6HYUEXNk.mjs';
+import { M as MessageQueue2, r as registerKillSessionHandler } from './registerKillSessionHandler-GYvHdipX.mjs';
+import { readSettings } from './persistence-HGW_ZVs9.mjs';
+import { g as getInitialMachineMetadata } from './machineMetadata-oOzBfDfs.mjs';
+import { c as createSessionMetadata } from './createSessionMetadata-CVVkGjxV.mjs';
+import { s as setupOfflineReconnection } from './setupOfflineReconnection-DpvWTt69.mjs';
+import { n as notifyDaemonSessionStarted } from './controlClient-BGbDcgWS.mjs';
+import { e as encodeBase64 } from './authRelay-DSAvg1uv.mjs';
 import WebSocket from 'ws';
 import * as ed from '@noble/ed25519';
 import { sha512 } from '@noble/hashes/sha2.js';
+import { f as ensurePrivateDirectorySync, h as hardenPrivateFileSync, w as writePrivateFileSync, c as configuration } from './configuration-RfeNjFmd.mjs';
+import { e as errorLogMetadata, c as contentLogMetadata } from './contentLogMetadata-BlWI0egu.mjs';
 import 'axios';
 import 'node:events';
 import 'socket.io-client';
+import './attachmentLimits-yba1uHFO.mjs';
 import 'zod';
+import './index-qdS1friN.mjs';
+import '@paralleldrive/cuid2';
+import './limits-DIo7rEBR.mjs';
+import './time-D0XyHOid.mjs';
+import './lidState-CeEt442o.mjs';
+import 'os';
 import 'child_process';
+import './registerCommonHandlers-Ccvsz7Ou.mjs';
 import 'util';
 import 'fs/promises';
 import 'crypto';
 import 'path';
 import 'cross-spawn';
-import './terminalTitleSuggest-DKgX3osW.mjs';
+import './projectPath-BTBIMB57.mjs';
 import 'url';
-import 'os';
-import '@paralleldrive/cuid2';
-import 'node:fs/promises';
-import 'node-pty';
-import 'fs';
-import 'tweetnacl';
-import 'node:readline';
-import '@anthropic-ai/sandbox-runtime';
-import 'expo-server-sdk';
+import './sync-C8gyQFMc.mjs';
+import './backgroundTaskActivity-8PdPxrvy.mjs';
 import 'chalk';
 import 'node:util';
-import './agentGuidance-KgvYuF3R.mjs';
-import 'ink';
-import 'react';
-import '@anthropic-ai/claude-agent-sdk';
-import 'ps-list';
-import 'tmp';
-import 'open';
-import 'fastify';
-import 'fastify-type-provider-zod';
-import 'node:module';
-import '@modelcontextprotocol/sdk/server/mcp.js';
-import 'node:http';
-import '@modelcontextprotocol/sdk/server/streamableHttp.js';
-import 'http';
-import 'inquirer';
-import 'node:url';
-import 'node:readline/promises';
+import 'tweetnacl';
+import './types-CkqAACXx.mjs';
+import 'node:fs/promises';
+import './package-BhaKlnxz.mjs';
+import './detectCLI-CSGMlV51.mjs';
+import 'fs';
+import './localHappyAgentAuth-C-HQyiv6.mjs';
 
 ed.hashes.sha512 = (message) => sha512(message);
 const { getPublicKeyAsync, signAsync, utils } = ed;
@@ -819,7 +818,7 @@ async function runOpenClaw(opts) {
   }
   await api.getOrCreateMachine({
     machineId: settings.machineId,
-    metadata: initialMachineMetadata
+    metadata: getInitialMachineMetadata()
   });
   const { state, metadata } = createSessionMetadata({
     flavor: "openclaw",

package/dist/sandbox-CG7IyDTU.cjs

@@ -0,0 +1,187 @@
+'use strict';
+
+var chalk = require('chalk');
+var inquirer = require('inquirer');
+var node_fs = require('node:fs');
+var os = require('node:os');
+var persistence = require('./persistence-yKTH3-5X.cjs');
+require('node:fs/promises');
+require('./configuration-BSYpcPwE.cjs');
+require('node:path');
+require('./package-BwMrPwqH.cjs');
+require('zod');
+require('./authRelay-BdYkC1Po.cjs');
+require('node:crypto');
+require('tweetnacl');
+require('./logger-CS0mw3fa.cjs');
+require('node:util');
+
+const DEFAULT_WORKSPACE_ROOT = "~/Workspace";
+const DEFAULT_DENY_READ_PATHS = ["~/.ssh", "~/.aws", "~/.gnupg"];
+function workspaceCandidatesForPlatform(platform) {
+  if (platform === "darwin") {
+    return ["~/Developer", "~/Develop", "~/Workspace"];
+  }
+  if (platform === "linux") {
+    return ["~/Workspace", "~/Developer", "~/Develop"];
+  }
+  return ["~/Developer", "~/Develop", "~/Workspace"];
+}
+function detectWorkspaceRootSuggestions(options) {
+  const platform = options?.platform ?? process.platform;
+  const home = options?.home ?? os.homedir();
+  const pathExists = options?.pathExists ?? node_fs.existsSync;
+  const candidates = workspaceCandidatesForPlatform(platform);
+  const existing = candidates.filter((candidate) => {
+    const absolutePath = candidate.replace(/^~(?=\/|$)/, home);
+    return pathExists(absolutePath);
+  });
+  if (existing.length > 0) {
+    return existing;
+  }
+  return [candidates[0] ?? DEFAULT_WORKSPACE_ROOT];
+}
+async function handleSandboxCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    handleSandboxHelp();
+    return;
+  }
+  switch (subcommand) {
+    case "configure":
+      await handleSandboxConfigure();
+      break;
+    case "status":
+      await handleSandboxStatus();
+      break;
+    case "disable":
+      await handleSandboxDisable();
+      break;
+    default:
+      console.error(chalk.red(`Unknown sandbox subcommand: ${subcommand}`));
+      handleSandboxHelp();
+      process.exit(1);
+  }
+}
+async function handleSandboxConfigure() {
+  const workspaceRootSuggestions = detectWorkspaceRootSuggestions();
+  const workspaceRootDefault = workspaceRootSuggestions[0] ?? DEFAULT_WORKSPACE_ROOT;
+  const answers = await inquirer.prompt([
+    {
+      type: "list",
+      name: "scopeMode",
+      message: "How should file access be scoped?",
+      default: "workspace",
+      choices: [
+        { name: "workspace - Full workspace root directory", value: "workspace" },
+        { name: "per-project - Only current project directory", value: "project" }
+      ]
+    },
+    {
+      type: "list",
+      name: "workspaceRoot",
+      message: "Pick your workspace root directory",
+      when: (currentAnswers) => currentAnswers.scopeMode === "workspace",
+      default: workspaceRootDefault,
+      choices: workspaceRootSuggestions.map((pathValue) => ({
+        name: `${pathValue}${node_fs.existsSync(pathValue.replace(/^~(?=\/|$)/, os.homedir())) ? "" : " (suggested)"}`,
+        value: pathValue
+      }))
+    },
+    {
+      type: "list",
+      name: "networkMode",
+      message: "How should network access be handled?",
+      default: "allowed",
+      choices: [
+        { name: "allowed - Allow all network access (default)", value: "allowed" },
+        { name: "blocked - Block all network access (most secure)", value: "blocked" }
+      ]
+    },
+    {
+      type: "confirm",
+      name: "allowLocalBinding",
+      message: "Allow binding to localhost ports? (for dev servers)",
+      default: true
+    }
+  ]);
+  const scopeMode = answers.scopeMode;
+  const sandboxConfig = persistence.SandboxConfigSchema.parse({
+    enabled: true,
+    workspaceRoot: scopeMode === "workspace" ? answers.workspaceRoot || workspaceRootDefault : void 0,
+    sessionIsolation: scopeMode === "workspace" ? "workspace" : "strict",
+    customWritePaths: [],
+    denyReadPaths: DEFAULT_DENY_READ_PATHS,
+    extraWritePaths: ["/tmp"],
+    denyWritePaths: [".env"],
+    networkMode: answers.networkMode,
+    allowedDomains: [],
+    deniedDomains: [],
+    allowLocalBinding: Boolean(answers.allowLocalBinding)
+  });
+  console.log(chalk.bold("\nSandbox configuration summary:"));
+  console.log(JSON.stringify(sandboxConfig, null, 2));
+  const { confirmSave } = await inquirer.prompt([
+    {
+      type: "confirm",
+      name: "confirmSave",
+      message: "Save and enable this sandbox configuration?",
+      default: true
+    }
+  ]);
+  if (!confirmSave) {
+    console.log(chalk.yellow("Sandbox configuration cancelled."));
+    return;
+  }
+  await persistence.updateSettings((settings) => ({
+    ...settings,
+    sandboxConfig
+  }));
+  console.log(chalk.green("Sandbox configuration saved and enabled."));
+  console.log(chalk.gray("Use --no-sandbox to bypass sandboxing for a single session."));
+}
+async function handleSandboxStatus() {
+  const settings = await persistence.readSettings();
+  const config = settings.sandboxConfig;
+  if (!config) {
+    console.log("Sandbox is not configured. Run `very-happy sandbox configure`.");
+    return;
+  }
+  console.log(chalk.bold("Sandbox status"));
+  console.log(`Enabled: ${config.enabled ? "yes" : "no"}`);
+  const scope = config.sessionIsolation === "workspace" ? "workspace" : "per-project";
+  console.log(`Scope: ${scope}`);
+  if (scope === "workspace") {
+    console.log(`Workspace root: ${config.workspaceRoot ?? DEFAULT_WORKSPACE_ROOT}`);
+  }
+  console.log(`Network mode: ${config.networkMode}`);
+  console.log(`Allow localhost binding: ${config.allowLocalBinding ? "yes" : "no"}`);
+}
+async function handleSandboxDisable() {
+  await persistence.updateSettings((settings) => ({
+    ...settings,
+    sandboxConfig: persistence.SandboxConfigSchema.parse({
+      ...settings.sandboxConfig ?? {},
+      enabled: false
+    })
+  }));
+  console.log(chalk.green("Sandbox disabled."));
+}
+function handleSandboxHelp() {
+  console.log(`
+${chalk.bold("very-happy sandbox")} - Sandbox management
+
+${chalk.bold("Usage:")}
+  very-happy sandbox configure      Configure sandbox settings interactively
+  very-happy sandbox status         Show current sandbox configuration
+  very-happy sandbox disable        Disable sandboxing
+  very-happy sandbox help           Show this help
+`);
+}
+
+exports.detectWorkspaceRootSuggestions = detectWorkspaceRootSuggestions;
+exports.handleSandboxCommand = handleSandboxCommand;
+exports.handleSandboxConfigure = handleSandboxConfigure;
+exports.handleSandboxDisable = handleSandboxDisable;
+exports.handleSandboxHelp = handleSandboxHelp;
+exports.handleSandboxStatus = handleSandboxStatus;