zidane 7.0.31 → 7.1.1

package/dist/{contexts-BSFQVclW.js → contexts-CRE9pw07.js}

@@ -1,9 +1,493 @@
 import { t as lazyAsync } from "./lazy-DLOurOC_.js";
 import { n as globLiteralPrefix, t as globFilesLocal } from "./glob-DluQFSw1.js";
 import { a as outputExceededMessage, n as appendCapped, t as DEFAULT_MAX_OUTPUT_BUFFER } from "./output-cap-C9zukcCj.js";
-import { dirname, isAbsolute, relative, resolve } from "node:path";
-import { createWriteStream } from "node:fs";
+import { delimiter, dirname, isAbsolute, join, relative, resolve } from "node:path";
+import { accessSync, constants, createWriteStream, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
 import { mkdir, readFile, readdir, realpath, stat, writeFile } from "node:fs/promises";
+//#region src/contexts/isolation.ts
+/**
+* Only `/usr/bin/sandbox-exec` is trusted — never a `PATH` lookup — so a
+* tampered binary earlier in `PATH` cannot silently replace the sandbox.
+*/
+const SEATBELT_EXECUTABLE = "/usr/bin/sandbox-exec";
+/**
+* Credential material hidden from sandboxed commands by default. Relative
+* to `$HOME`; resolved at policy-build time. Covers the usual suspects plus
+* zidane's own OAuth / API-key store.
+*/
+const DEFAULT_UNREADABLE_DIRS = [
+	".ssh",
+	".aws",
+	".gnupg",
+	".azure",
+	".config/gcloud",
+	".kube",
+	".docker/config.json",
+	".netrc",
+	".zidane/credentials.json",
+	".zidane/mcp-credentials.json",
+	".credentials.json"
+];
+/** Backend for `platform` (defaults to the current process). `null` = unsupported OS. */
+function detectIsolationBackend(platform = process.platform) {
+	if (platform === "darwin") return "seatbelt";
+	if (platform === "linux") return "bwrap";
+	return null;
+}
+function isExecutable(path) {
+	try {
+		accessSync(path, constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function whichSync(name, env = process.env) {
+	for (const dir of (env.PATH ?? "").split(delimiter)) {
+		if (!dir) continue;
+		const candidate = join(dir, name);
+		if (isExecutable(candidate)) return candidate;
+	}
+	return null;
+}
+/**
+* Whether the sandbox can actually be enforced on this host. Callers that
+* requested isolation and get `ok: false` MUST fail closed (refuse to run
+* the command) — silently running unsandboxed would turn a security
+* setting into a placebo.
+*/
+function isolationAvailability(platform = process.platform, env = process.env) {
+	const backend = detectIsolationBackend(platform);
+	if (backend === null) return {
+		ok: false,
+		reason: `OS sandboxing is not supported on ${platform} (macOS Seatbelt and Linux bwrap only)`
+	};
+	if (backend === "seatbelt") return isExecutable("/usr/bin/sandbox-exec") ? {
+		ok: true,
+		backend,
+		executable: SEATBELT_EXECUTABLE
+	} : {
+		ok: false,
+		reason: `${SEATBELT_EXECUTABLE} is missing or not executable`
+	};
+	const bwrap = whichSync("bwrap", env);
+	return bwrap ? {
+		ok: true,
+		backend,
+		executable: bwrap
+	} : {
+		ok: false,
+		reason: "bwrap (bubblewrap) is not installed — install it with your package manager (e.g. `apt install bubblewrap`)"
+	};
+}
+/** Expand a leading `~` / `~/` to `home`. Other paths returned unchanged. */
+function expandHome(path, home = homedir()) {
+	if (path === "~") return home;
+	if (path.startsWith("~/")) return join(home, path.slice(2));
+	return path;
+}
+/**
+* Parse the user-facing "extra writable paths" setting: comma- or
+* newline-separated, `~` expanded, relative entries resolved against `cwd`,
+* blanks dropped.
+*/
+function parseAllowWriteSetting(raw, cwd, home = homedir()) {
+	return raw.split(/[,\n]/).map((s) => s.trim()).filter(Boolean).map((p) => resolve(cwd, expandHome(p, home)));
+}
+/**
+* `realpath` that also works for paths that don't exist yet (an `extra`
+* root the user hasn't created): the deepest existing ancestor is
+* canonicalized and the missing tail re-appended. Without this, `/tmp/x`
+* and `/private/tmp/x` would look like different roots on macOS.
+*/
+function canonical(path) {
+	let existing = resolve(path);
+	const tail = [];
+	while (true) try {
+		existing = realpathSync(existing);
+		break;
+	} catch {
+		const parent = dirname(existing);
+		if (parent === existing) break;
+		tail.unshift(relative(parent, existing));
+		existing = parent;
+	}
+	return tail.length ? resolve(existing, ...tail) : existing;
+}
+/** True when `target` is `root` or lives under it. */
+function isWithinRoot(root, target) {
+	const rel = relative(root, target);
+	return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+}
+/** Drop roots already covered by another root in the list; keeps first-seen order. */
+function dedupeRoots(roots) {
+	const out = [];
+	for (const root of roots) {
+		if (out.some((existing) => isWithinRoot(existing, root))) continue;
+		for (let i = out.length - 1; i >= 0; i--) if (isWithinRoot(root, out[i])) out.splice(i, 1);
+		out.push(root);
+	}
+	return out;
+}
+/**
+* Why git's common dir matters: `git rev-parse --git-common-dir` prints a
+* path relative to cwd for the primary checkout (`.git`) and an absolute
+* path for linked worktrees. Without the worktree's common dir writable,
+* `git commit` / `git add` inside a worktree fail under the sandbox —
+* the index and objects live in the main repo's `.git`.
+*
+* Two probes, one contract (`null` on any failure, including no `git`
+* binary, a non-repo, or a slow git — a wedged git must not wedge the
+* host, so slow reads as "not a worktree"):
+* - {@link defaultGitCommonDir}: synchronous, for the in-process TUI whose
+*   `buildAgent` is sync. Blocks that window only; 1 s cap.
+* - {@link defaultGitCommonDirAsync}: for the daemon, where a sync probe
+*   would stall every window and session on the shared event loop.
+*
+* `node:child_process` is resolved through `process.getBuiltinModule` (not a
+* static import) for the same reason `process.ts` lazy-loads `spawn`: this
+* module sits in the default execution context's import graph, and merely
+* importing zidane must stay possible on shell-less runtimes (edge isolates)
+* where that builtin is gated. Node 20.16+ / Bun; `undefined` → `null`.
+*/
+const GIT_PROBE_ARGS = ["rev-parse", "--git-common-dir"];
+const GIT_PROBE_SYNC_TIMEOUT_MS = 1e3;
+const GIT_PROBE_ASYNC_TIMEOUT_MS = 3e3;
+function childProcess() {
+	return process.getBuiltinModule?.("node:child_process");
+}
+function defaultGitCommonDir(cwd) {
+	try {
+		const cp = childProcess();
+		if (!cp) return null;
+		const out = cp.execFileSync("git", GIT_PROBE_ARGS, {
+			cwd,
+			timeout: GIT_PROBE_SYNC_TIMEOUT_MS,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return out ? resolve(cwd, out) : null;
+	} catch {
+		return null;
+	}
+}
+function defaultGitCommonDirAsync(cwd) {
+	const cp = childProcess();
+	if (!cp) return Promise.resolve(null);
+	return new Promise((resolveP) => {
+		try {
+			cp.execFile("git", GIT_PROBE_ARGS, {
+				cwd,
+				timeout: GIT_PROBE_ASYNC_TIMEOUT_MS,
+				encoding: "utf8"
+			}, (err, stdout) => {
+				if (err) return resolveP(null);
+				const out = stdout.trim();
+				resolveP(out ? resolve(cwd, out) : null);
+			});
+		} catch {
+			resolveP(null);
+		}
+	});
+}
+/**
+* The set of directories a sandboxed command may write to: the workspace
+* (`cwd`), the system temp dirs, git's common dir when `cwd` is a linked
+* worktree, plus any user-configured extras. All canonicalized.
+*/
+function resolveWritableRoots(cwd, options = {}) {
+	return assembleWritableRoots(cwd, (options.gitCommonDir ?? defaultGitCommonDir)(cwd), options);
+}
+/** Async twin of {@link resolveWritableRoots} for hosts that must not block (the daemon). */
+async function resolveWritableRootsAsync(cwd, options = {}) {
+	return assembleWritableRoots(cwd, await (options.gitCommonDir ?? defaultGitCommonDirAsync)(cwd), options);
+}
+function assembleWritableRoots(cwd, gitCommonDir, options) {
+	const env = options.env ?? process.env;
+	const platform = options.platform ?? process.platform;
+	const raw = [cwd];
+	if (env.TMPDIR) raw.push(env.TMPDIR);
+	raw.push("/tmp", "/var/tmp");
+	if (platform === "darwin") raw.push("/private/tmp", "/private/var/tmp");
+	if (gitCommonDir) raw.push(gitCommonDir);
+	raw.push(...options.extra ?? []);
+	return dedupeRoots(raw.map(canonical));
+}
+/** Resolve {@link DEFAULT_UNREADABLE_DIRS} (or a custom list) against `home`. */
+function resolveUnreadableDirs(dirs = DEFAULT_UNREADABLE_DIRS, home = homedir()) {
+	return dirs.map((d) => isAbsolute(d) ? d : join(home, d));
+}
+/**
+* Deny-default base. Derived from Codex's `seatbelt_base_policy.sbpl`
+* (Apache-2.0), itself from Chromium's renderer/common sandbox policies.
+* Filesystem READ is allowed broadly (below); WRITE and NETWORK are added
+* per policy in {@link buildSeatbeltProfile}.
+*/
+const SEATBELT_BASE_POLICY = `(version 1)
+
+; deny-default; everything below is an explicit allow
+(deny default)
+
+; child processes inherit the policy of their parent
+(allow process-exec)
+(allow process-fork)
+(allow signal (target same-sandbox))
+(allow process-info* (target same-sandbox))
+
+; reads are allowed everywhere except the unreadable roots. SBPL is
+; LAST-MATCH-WINS: the deny block for those roots is emitted at the very
+; end of the profile by buildSeatbeltProfile and must stay there.
+(allow file-read*)
+(allow file-write* (literal "/dev/null"))
+(allow file-read* file-write* (literal "/dev/stdin"))
+(allow file-read* file-write* (literal "/dev/stdout"))
+(allow file-read* file-write* (literal "/dev/stderr"))
+(allow file-read* file-write* (literal "/dev/tty"))
+(allow file-read* file-write* (literal "/dev/random"))
+(allow file-read* file-write* (literal "/dev/urandom"))
+(allow file-read* file-write* (literal "/dev/zero"))
+(allow file-ioctl (literal "/dev/dtracehelper"))
+(allow file-read* file-write* (literal "/dev/dtracehelper"))
+
+; sysctls
+(allow sysctl-read
+  (sysctl-name "hw.activecpu")
+  (sysctl-name "hw.busfrequency_compat")
+  (sysctl-name "hw.byteorder")
+  (sysctl-name "hw.cacheconfig")
+  (sysctl-name "hw.cachelinesize_compat")
+  (sysctl-name "hw.cpufamily")
+  (sysctl-name "hw.cpufrequency_compat")
+  (sysctl-name "hw.cputype")
+  (sysctl-name "hw.l1dcachesize_compat")
+  (sysctl-name "hw.l1icachesize_compat")
+  (sysctl-name "hw.l2cachesize_compat")
+  (sysctl-name "hw.l3cachesize_compat")
+  (sysctl-name "hw.logicalcpu_max")
+  (sysctl-name "hw.machine")
+  (sysctl-name "hw.model")
+  (sysctl-name "hw.memsize")
+  (sysctl-name "hw.ncpu")
+  (sysctl-name "hw.nperflevels")
+  (sysctl-name-prefix "hw.optional.arm.")
+  (sysctl-name-prefix "hw.optional.armv8_")
+  (sysctl-name "hw.packages")
+  (sysctl-name "hw.pagesize_compat")
+  (sysctl-name "hw.pagesize")
+  (sysctl-name "hw.physicalcpu")
+  (sysctl-name "hw.physicalcpu_max")
+  (sysctl-name "hw.logicalcpu")
+  (sysctl-name "hw.cpufrequency")
+  (sysctl-name "hw.tbfrequency_compat")
+  (sysctl-name "hw.vectorunit")
+  (sysctl-name "machdep.cpu.brand_string")
+  (sysctl-name "kern.argmax")
+  (sysctl-name "kern.hostname")
+  (sysctl-name "kern.maxfilesperproc")
+  (sysctl-name "kern.maxproc")
+  (sysctl-name "kern.osproductversion")
+  (sysctl-name "kern.osrelease")
+  (sysctl-name "kern.ostype")
+  (sysctl-name "kern.osvariant_status")
+  (sysctl-name "kern.osversion")
+  (sysctl-name "kern.secure_kernel")
+  (sysctl-name "kern.sysv.semmns")
+  (sysctl-name "kern.usrstack64")
+  (sysctl-name "kern.version")
+  (sysctl-name "sysctl.proc_cputype")
+  (sysctl-name "vm.loadavg")
+  (sysctl-name-prefix "hw.perflevel")
+  (sysctl-name-prefix "kern.proc.pgrp.")
+  (sysctl-name-prefix "kern.proc.pid.")
+  (sysctl-name-prefix "net.routetable.")
+)
+; Java CPU probe (a read that the kernel classifies as a write)
+(allow sysctl-write (sysctl-name "kern.grade_cputype"))
+
+(allow iokit-open (iokit-registry-entry-class "RootDomainUserClient"))
+
+; user lookup (getpwuid & co)
+(allow mach-lookup (global-name "com.apple.system.opendirectoryd.libinfo"))
+(allow mach-lookup (global-name "com.apple.PowerManagement.control"))
+
+; python multiprocessing / OpenMP
+(allow ipc-posix-sem)
+(allow ipc-posix-shm-read-data
+  ipc-posix-shm-write-create
+  ipc-posix-shm-write-unlink
+  (ipc-posix-name-regex #"^/__KMP_REGISTERED_LIB_[0-9]+$"))
+
+; openpty()
+(allow pseudo-tty)
+(allow file-read* file-write* file-ioctl (literal "/dev/ptmx"))
+(allow file-read* file-write*
+  (require-all
+    (regex #"^/dev/ttys[0-9]+")
+    (extension "com.apple.sandbox.pty")))
+(allow file-ioctl (regex #"^/dev/ttys[0-9]+"))
+`;
+/**
+* Network allow block. Mirrors Codex's `seatbelt_network_policy.sbpl`: full
+* outbound/inbound plus the mach services TLS + DNS resolution need.
+*/
+const SEATBELT_NETWORK_POLICY = `
+; ---- network: allow ----
+(allow network-outbound)
+(allow network-inbound)
+(allow network-bind)
+(allow system-socket
+  (require-all
+    (socket-domain AF_SYSTEM)
+    (socket-protocol 2)))
+(allow mach-lookup
+  (global-name "com.apple.bsd.dirhelper")
+  (global-name "com.apple.system.opendirectoryd.membership")
+  (global-name "com.apple.SecurityServer")
+  (global-name "com.apple.networkd")
+  (global-name "com.apple.ocspd")
+  (global-name "com.apple.trustd.agent")
+  (global-name "com.apple.SystemConfiguration.DNSConfiguration")
+  (global-name "com.apple.SystemConfiguration.configd"))
+(allow sysctl-read (sysctl-name-regex #"^net.routetable"))
+`;
+const WRITABLE_ROOT_PARAM = "WRITABLE_ROOT_";
+const UNREADABLE_ROOT_PARAM = "UNREADABLE_ROOT_";
+/**
+* Build the SBPL profile + params for a policy. Paths are NEVER inlined in
+* the profile text: each is bound to a `-D` param and referenced via
+* `(param "…")`, so spaces, quotes and parentheses in paths need no
+* escaping and the profile text is identical across machines (only the
+* params differ) — which makes it unit-testable as a string.
+*
+* ORDERING IS A SECURITY INVARIANT. Seatbelt resolves overlapping rules by
+* position — the LAST matching rule wins; there is no deny-over-allow
+* precedence. The credential mask (`deny file-read*` on the unreadable
+* roots) only holds because it is the final block, after `(allow
+* file-read*)` in the base policy, the writable-root allows and the
+* network block. Never hoist or reorder it; the profile test asserts every
+* `(deny` line follows every `(allow` line.
+*/
+function buildSeatbeltProfile(policy, home = homedir()) {
+	const params = [];
+	const lines = [SEATBELT_BASE_POLICY];
+	lines.push("; ---- writable roots ----");
+	policy.writableRoots.forEach((root, i) => {
+		const key = `${WRITABLE_ROOT_PARAM}${i}`;
+		params.push([key, root]);
+		lines.push(`(allow file-write* (subpath (param "${key}")))`);
+	});
+	if (policy.network === "allow") lines.push(SEATBELT_NETWORK_POLICY);
+	else lines.push("; ---- network: deny (default deny covers all socket ops) ----");
+	const unreadable = resolveUnreadableDirs(policy.unreadableDirs, home);
+	if (unreadable.length > 0) {
+		lines.push("; ---- unreadable roots (must be the final block: last match wins) ----");
+		unreadable.forEach((dir, i) => {
+			const key = `${UNREADABLE_ROOT_PARAM}${i}`;
+			params.push([key, dir]);
+			lines.push(`(deny file-read* file-write* (subpath (param "${key}")))`);
+		});
+	}
+	return {
+		profile: `${lines.join("\n")}\n`,
+		params
+	};
+}
+/**
+* bwrap argv for a policy (without the trailing command). The whole host FS
+* is bound read-only, writable roots are re-bound read-write on top, and
+* unreadable dirs are masked with an empty tmpfs. `--die-with-parent` ties
+* the sandbox to the zidane process; no `--new-session`/`--unshare-pid` so
+* the child stays in the caller's process group (the process context kills
+* by `-pgid`) and `ps`/`kill` inside the sandbox behave as usual.
+*/
+function buildBwrapArgs(policy, home = homedir(), kind = statKind) {
+	const args = [
+		"--ro-bind",
+		"/",
+		"/",
+		"--dev",
+		"/dev",
+		"--proc",
+		"/proc",
+		"--die-with-parent"
+	];
+	for (const root of policy.writableRoots) args.push("--bind-try", root, root);
+	for (const path of resolveUnreadableDirs(policy.unreadableDirs, home)) {
+		const k = kind(path);
+		if (k === "dir") args.push("--tmpfs", path);
+		else if (k === "file") args.push("--ro-bind", "/dev/null", path);
+	}
+	if (policy.network === "deny") args.push("--unshare-net");
+	return args;
+}
+function statKind(path) {
+	try {
+		return statSync(path).isDirectory() ? "dir" : "file";
+	} catch {
+		return null;
+	}
+}
+/**
+* Produce the `{ file, args }` that runs `/bin/sh -c command` under the
+* sandbox. `home` is injectable for tests.
+*/
+function wrapCommand(backend, executable, policy, command, home = homedir()) {
+	if (backend === "seatbelt") {
+		const { profile, params } = buildSeatbeltProfile(policy, home);
+		const args = ["-p", profile];
+		for (const [key, value] of params) args.push(`-D${key}=${value}`);
+		args.push("--", "/bin/sh", "-c", command);
+		return {
+			file: executable,
+			args
+		};
+	}
+	return {
+		file: executable,
+		args: [
+			...buildBwrapArgs(policy, home),
+			"--",
+			"/bin/sh",
+			"-c",
+			command
+		]
+	};
+}
+/**
+* Patterns a sandboxed command emits when the kernel refuses an operation.
+* Seatbelt surfaces `Operation not permitted` (EPERM); bwrap's read-only
+* root yields `Read-only file system` (EROFS); an unshared netns gives
+* DNS / connect failures that vary by tool, so only the two FS ones are
+* matched — network denial is reported through `network: deny` text.
+*/
+const DENIAL_RE = /Operation not permitted|Read-only file system|sandbox-exec: |deny\(1\)|bwrap: /i;
+/**
+* Append a one-line explanation to a failed result when the failure looks
+* like a sandbox denial. The model otherwise sees a bare EPERM and guesses;
+* this names the mechanism and the exact setting that widens it.
+*/
+function annotateDenial(result, policy) {
+	if (result.exitCode === 0 || !DENIAL_RE.test(result.stderr)) return result;
+	const hint = `[sandbox] this command ran under zidane's OS sandbox: writes are limited to ${policy.writableRoots.join(", ")}${policy.network === "deny" ? "; network is blocked" : ""}. If the failure is a sandbox denial, ask the user to add the path under Settings → "Sandbox writable paths" or turn off "Sandbox shell commands".`;
+	return {
+		...result,
+		stderr: result.stderr ? `${result.stderr}\n${hint}` : hint
+	};
+}
+/** Result returned for every command when isolation was requested but cannot be enforced. */
+function unavailableResult(reason) {
+	return {
+		stdout: "",
+		stderr: `[sandbox] "Sandbox shell commands" is on but cannot be enforced: ${reason}. Refusing to run unsandboxed — ask the user to fix the sandbox or turn the setting off.`,
+		exitCode: 127
+	};
+}
+//#endregion
 //#region src/contexts/process.ts
 /**
 * Lazily load `node:child_process`'s `spawn` (memoized after first use).
@@ -113,10 +597,23 @@ function createProcessContext(config) {
 		"TMPDIR"
 	]) : process.env;
 	const workspaceRoot = config?.workspaceRoot !== void 0 ? resolve(defaultCwd, config.workspaceRoot) : void 0;
-	/** True when `target` is the root itself or lives under it. */
-	function isWithinRoot(root, target) {
-		const rel = relative(root, target);
-		return rel === "" || !rel.startsWith("..") && !isAbsolute(rel);
+	const isolation = config?.isolation;
+	const isolationState = isolation ? isolationAvailability() : void 0;
+	/**
+	* `{ file, args }` for `/bin/sh -c command`, wrapped in the sandbox when
+	* isolation is on. Callers check `isolationState.ok` first (the three
+	* shell entry points return `unavailableResult` / throw before spawning).
+	*/
+	function shellCommand(command) {
+		if (isolation && isolationState?.ok) return wrapCommand(isolationState.backend, isolationState.executable, isolation, command);
+		return {
+			file: "/bin/sh",
+			args: ["-c", command]
+		};
+	}
+	/** Failure result when isolation was requested but cannot be enforced; `undefined` = proceed. */
+	function isolationBlocker() {
+		return isolationState && !isolationState.ok ? unavailableResult(isolationState.reason) : void 0;
 	}
 	/**
 	* Resolve `path` against the handle cwd and, when a `workspaceRoot` is
@@ -127,6 +624,16 @@ function createProcessContext(config) {
 	async function resolveContained(handle, path) {
 		const full = resolve(handle.cwd, path);
 		if (workspaceRoot === void 0) return full;
+		const canonical = await canonicalizeForCheck(full);
+		const canonicalRoot = await realpath(workspaceRoot).catch(() => workspaceRoot);
+		if (!isWithinRoot(canonicalRoot, canonical)) throw new Error(`Path escapes the workspace root: ${path} (resolved outside ${canonicalRoot})`);
+		return full;
+	}
+	/**
+	* Canonicalize the deepest existing ancestor of `full` to defeat symlink
+	* escapes; the non-existent tail (for writes) is appended back verbatim.
+	*/
+	async function canonicalizeForCheck(full) {
 		let existing = full;
 		const tail = [];
 		while (true) try {
@@ -141,10 +648,18 @@ function createProcessContext(config) {
 			tail.unshift(relative(parent, existing));
 			existing = parent;
 		}
-		const canonical = tail.length ? resolve(existing, ...tail) : existing;
-		const canonicalRoot = await realpath(workspaceRoot).catch(() => workspaceRoot);
-		if (!isWithinRoot(canonicalRoot, canonical)) throw new Error(`Path escapes the workspace root: ${path} (resolved outside ${canonicalRoot})`);
-		return full;
+		return tail.length ? resolve(existing, ...tail) : existing;
+	}
+	/**
+	* In-process counterpart of the sandbox's write policy: `writeFile` (and
+	* so the `write_file` / `edit` tools) may only target `isolation.writableRoots`.
+	* Reads are deliberately unrestricted — same boundary the kernel enforces
+	* for shell commands, so the two never disagree about where writes land.
+	*/
+	async function assertWritable(full, path) {
+		if (!isolation) return;
+		const canonical = await canonicalizeForCheck(full);
+		if (!isolation.writableRoots.some((root) => isWithinRoot(root, canonical))) throw new Error(`[sandbox] write denied: ${path} is outside the writable roots (${isolation.writableRoots.join(", ")}). Ask the user to add it under Settings → "Sandbox writable paths" or turn off "Sandbox shell commands".`);
 	}
 	/**
 	* Per-context background-task registry. Entries live for the context's
@@ -224,6 +739,7 @@ function createProcessContext(config) {
 			network: true,
 			gpu: false,
 			stream: true,
+			isolated: isolation !== void 0 && isolationState?.ok === true,
 			detachedTasks: "process-lifetime"
 		},
 		async spawn(overrides) {
@@ -251,11 +767,14 @@ function createProcessContext(config) {
 				stderr: "aborted by signal before spawn",
 				exitCode: 143
 			};
+			const blocked = isolationBlocker();
+			if (blocked) return blocked;
 			const timeoutMs = (options?.timeout ?? config?.limits?.timeout ?? 30) * 1e3;
 			const maxBuffer = DEFAULT_MAX_OUTPUT_BUFFER;
 			const spawnChild = await loadSpawn();
 			return new Promise((resolveP) => {
-				const child = spawnChild("/bin/sh", ["-c", command], {
+				const shell = shellCommand(command);
+				const child = spawnChild(shell.file, shell.args, {
 					cwd,
 					env: {
 						...baseEnv,
@@ -313,11 +832,12 @@ function createProcessContext(config) {
 					if (exitGraceTimer) clearTimeout(exitGraceTimer);
 					if (userSignal) userSignal.removeEventListener("abort", onAbort);
 					const finalStderr = extraStderr ? stderrSlot.text ? `${stderrSlot.text}\n${extraStderr}` : extraStderr : stderrSlot.text;
-					resolveP({
+					const result = {
 						stdout: stdoutSlot.text,
 						stderr: finalStderr,
 						exitCode
-					});
+					};
+					resolveP(isolation ? annotateDenial(result, isolation) : result);
 				};
 				const settleFromStatus = (code, signal) => {
 					if (killedByAbort) {
@@ -370,6 +890,7 @@ function createProcessContext(config) {
 		},
 		async writeFile(handle, path, content, encoding = "utf-8") {
 			const fullPath = await resolveContained(handle, path);
+			await assertWritable(fullPath, path);
 			await mkdir(dirname(fullPath), { recursive: true });
 			if (typeof content === "string") await writeFile(fullPath, content, encoding);
 			else await writeFile(fullPath, content);
@@ -414,7 +935,10 @@ function createProcessContext(config) {
 			const cwd = options?.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd;
 			const spawnChild = await loadSpawn();
 			options?.signal?.throwIfAborted();
-			const child = spawnChild("/bin/sh", ["-c", command], {
+			const blocked = isolationBlocker();
+			if (blocked) throw new Error(blocked.stderr);
+			const shell = shellCommand(command);
+			const child = spawnChild(shell.file, shell.args, {
 				cwd,
 				env: {
 					...baseEnv,
@@ -477,6 +1001,8 @@ function createProcessContext(config) {
 		async execBackground(handle, command, options) {
 			const cwd = options.cwd ? resolve(handle.cwd, options.cwd) : handle.cwd;
 			const spawnChild = await loadSpawn();
+			const blocked = isolationBlocker();
+			if (blocked) throw new Error(blocked.stderr);
 			await mkdir(options.outputDir, { recursive: true });
 			const taskId = `bash_${++taskCounter}`;
 			assertSafeTaskId(taskId);
@@ -486,7 +1012,8 @@ function createProcessContext(config) {
 			outputStream.on("error", (err) => {
 				if (process.env.ZIDANE_DEBUG) process.stderr.write(`[zidane/contexts] task ${taskId} log stream error: ${err.message}\n`);
 			});
-			const child = spawnChild("/bin/sh", ["-c", command], {
+			const shell = shellCommand(command);
+			const child = spawnChild(shell.file, shell.args, {
 				cwd,
 				env: {
 					...baseEnv,
@@ -785,6 +1312,6 @@ function resolveDetachedTasksCapability(context) {
 	return context.capabilities.detachedTasks ?? (context.execBackground ? "process-lifetime" : "none");
 }
 //#endregion
-export { killProcessGroup as i, SUPPORTS_PROCESS_GROUPS as n, createProcessContext as r, resolveDetachedTasksCapability as t };
+export { DEFAULT_UNREADABLE_DIRS as a, resolveUnreadableDirs as c, killProcessGroup as i, resolveWritableRoots as l, SUPPORTS_PROCESS_GROUPS as n, isolationAvailability as o, createProcessContext as r, parseAllowWriteSetting as s, resolveDetachedTasksCapability as t, resolveWritableRootsAsync as u };
 
-//# sourceMappingURL=contexts-BSFQVclW.js.map
+//# sourceMappingURL=contexts-CRE9pw07.js.map