lcode-cli 0.4.1__py3-none-any.whl → 0.5.0__py3-none-any.whl

lcode/__init__.py

@@ -1,3 +1,3 @@
 """lcode — a local-first terminal coding agent powered by open-weight models via Ollama."""
 
-__version__ = "0.4.1"
+__version__ = "0.5.0"

lcode/agent.py

@@ -26,6 +26,7 @@ from lcode.mcp import McpManager
 from lcode.ollama import Ollama, OllamaError
 from lcode.permissions import Permissions
 from lcode.render import MarkdownStreamer
+from lcode.sandbox import Sandbox, SandboxError, project_root
 from lcode.tools import (
     SCHEMAS,
     WEB_FETCH_SCHEMA,
@@ -140,6 +141,9 @@ class Settings:
     search_backend: str = "auto"
     searxng_url: str | None = None
     checkpoints: bool = True  # snapshot files before the model changes them, for /undo
+    sandbox: str = "off"  # off, docker or podman: where the model's shell commands run
+    sandbox_image: str | None = None
+    sandbox_network: bool = False
 
 
 class Agent:
@@ -153,6 +157,11 @@ class Agent:
         self.session_id = self.new_session_id()
         self.checkpoints = Checkpoints(self.console, settings.checkpoints)
         self.mcp: McpManager | None = None  # set by the CLI when MCP servers are configured
+        self.sandbox = (
+            Sandbox(settings.sandbox, settings.sandbox_image, settings.sandbox_network, self.console)
+            if settings.sandbox != "off"
+            else None
+        )
         self._mcp_prompt = ""  # the MCP part at the end of the system prompt
         self.session_name = ""
         self.session_title = ""
@@ -462,6 +471,15 @@ class Agent:
         finally:
             self.checkpoints.end_turn()
 
+    def sandbox_root(self) -> Path | None:
+        """The folder the model is limited to while the sandbox is on (None when it's off)."""
+        if not self.sandbox:
+            return None
+        try:
+            return project_root(self.cwd)
+        except SandboxError:
+            return self.cwd
+
     def checkpoint(self) -> None:
         """Called before the model changes files: snapshot them once per request, for /undo."""
         self.checkpoints.before_change(self.cwd)

lcode/cli.py

@@ -321,6 +321,15 @@ def cmd_doctor(args) -> None:
     except ValueError as e:
         line("MCP", str(e), False)
         ok = False
+    if cfg["sandbox"] == "off":
+        line("Sandbox", "off (lcode config set sandbox docker)", True)
+    else:
+        from lcode.sandbox import engine_problem
+
+        problem = engine_problem(cfg["sandbox"])
+        network = "network on" if cfg["sandbox_network"] else "no network"
+        line("Sandbox", problem or f"{cfg['sandbox']} · {network}", problem is None)
+        ok &= problem is None
     node = shutil.which("npx")
     line("Node.js", "found" if node else "not found (some MCP servers need npx)", True if node else None)
     sys.exit(0 if ok else 1)
@@ -485,8 +494,20 @@ def cmd_chat(args) -> None:
         search_backend=cfg["search_backend"],
         searxng_url=cfg["searxng_url"],
         checkpoints=cfg["checkpoints"],
+        sandbox=(cfg["sandbox"] if cfg["sandbox"] != "off" else "docker") if args.sandbox else cfg["sandbox"],
+        sandbox_image=cfg["sandbox_image"],
+        sandbox_network=cfg["sandbox_network"],
     )
     agent = Agent(ollama, settings, cwd, console=console)
+    if agent.sandbox:
+        # Never run commands unsandboxed when the user asked for a sandbox: stop here instead.
+        from lcode.sandbox import SandboxError
+
+        try:
+            with console.status("Starting the sandbox…"):
+                agent.sandbox.ensure(cwd)
+        except SandboxError as e:
+            fail(f"the sandbox can't start: {e}\nTurn it off with: lcode config set sandbox off")
     if not args.no_mcp:
         from lcode.mcp.commands import start_session
 
@@ -496,6 +517,8 @@ def cmd_chat(args) -> None:
     finally:
         if agent.mcp:
             agent.mcp.close()
+        if agent.sandbox:
+            agent.sandbox.stop()
 
 
 def build_parser() -> argparse.ArgumentParser:
@@ -522,6 +545,7 @@ def build_parser() -> argparse.ArgumentParser:
     parser.add_argument("--no-think", action="store_true", help="disable model reasoning (faster, less accurate)")
     parser.add_argument("--no-web", action="store_true", help="don't let the model search or fetch web pages")
     parser.add_argument("--no-mcp", action="store_true", help="don't start MCP servers in this session")
+    parser.add_argument("--sandbox", action="store_true", help="run shell commands in a container (Docker or Podman)")
     parser.add_argument("--show-thinking", action="store_true", help="print the model's reasoning as it streams")
     parser.add_argument("-V", "--version", action="version", version=f"lcode {__version__}")
     return parser

lcode/config.py

@@ -25,6 +25,7 @@ PERMISSION_MODES = ("ask", "auto-edit", "yolo")
 WEB_MODES = ("on", "ask", "off")
 SEARCH_BACKENDS = ("auto", "ollama", "brave", "tavily", "searxng")
 MCP_TOOL_MODES = ("auto", "direct", "search")
+SANDBOX_ENGINES = ("off", "docker", "podman")
 
 # key -> (default, type, help)
 SETTINGS: dict[str, tuple[object, type, str]] = {
@@ -39,6 +40,9 @@ SETTINGS: dict[str, tuple[object, type, str]] = {
     "search_backend": ("auto", str, "auto | ollama | brave | tavily | searxng (keys come from environment variables)"),
     "searxng_url": (None, str, "your SearXNG instance, e.g. http://localhost:8888"),
     "checkpoints": (True, bool, "snapshot files before the model changes them, so /undo can restore them"),
+    "sandbox": ("off", str, "run the model's shell commands in a container: off | docker | podman"),
+    "sandbox_image": (None, str, "container image for the sandbox (default: lcode's, built on first use)"),
+    "sandbox_network": (False, bool, "let commands in the sandbox use the network"),
     "mcp_tools": ("auto", str, "how MCP tools reach the model: auto | direct | search (on demand, saves context)"),
 }
 ENV_OVERRIDES = {
@@ -48,6 +52,7 @@ ENV_OVERRIDES = {
     "LCODE_KEEP_ALIVE": "keep_alive",
     "OLLAMA_HOST": "ollama_host",
     "LCODE_WEB": "web",
+    "LCODE_SANDBOX": "sandbox",
 }
 
 
@@ -99,6 +104,11 @@ def coerce(key: str, value: object) -> object:
         if value not in WEB_MODES:
             raise ConfigError(f"web must be one of {', '.join(WEB_MODES)}")
         return value
+    if key == "sandbox":
+        value = {"none": "off", "false": "off", "no": "off"}.get(str(value).lower(), str(value).lower())
+        if value not in SANDBOX_ENGINES:
+            raise ConfigError(f"sandbox must be one of {', '.join(SANDBOX_ENGINES)}")
+        return value
     if key == "mcp_tools" and value not in MCP_TOOL_MODES:
         raise ConfigError(f"mcp_tools must be one of {', '.join(MCP_TOOL_MODES)}")
     if key == "search_backend" and value not in SEARCH_BACKENDS:

lcode/repl.py

@@ -39,6 +39,7 @@ COMMANDS = {
     "/undo": "Undo the file changes of the last request (lcode saves a checkpoint before changing files)",
     "/rewind": "Go back to before an earlier request: its files, and optionally the conversation",
     "/checkpoints": "List the requests that changed files, and which files",
+    "/sandbox": "Shell-command sandbox: status, or /sandbox network on|off",
     "/mcp": "MCP servers and their tools: /mcp, /mcp tools NAME, /mcp login NAME, /mcp restart NAME",
     "/compact": "Summarize the conversation to free context (optional: what to focus on)",
     "/context": "Show context usage and change the window size: pick from a list, or /context 128k",
@@ -143,6 +144,11 @@ def banner(agent: Agent) -> None:
                     f"[dim]mode[/]     {agent.perms.mode} [dim](Shift+Tab to cycle)[/]\n"
                     f"[dim]web[/]      {web_status(agent)}\n"
                     + (f"[dim]mcp[/]      {escape(', '.join(agent.mcp.servers))} [dim](/mcp)[/]\n" if agent.mcp else "")
+                    + (
+                        f"[dim]sandbox[/]  {escape(agent.sandbox.describe())} [dim](/sandbox)[/]\n"
+                        if agent.sandbox
+                        else ""
+                    )
                     + "\n"
                     "[dim]/help for commands · @file to attach · Esc+Enter for a newline[/]"
                 ),
@@ -240,6 +246,31 @@ def context_command(agent: Agent, arg: str, hardware: Hardware) -> None:
     apply_context(agent, size, hardware)
 
 
+def sandbox_command(agent: Agent, arg: str) -> None:
+    c, sandbox = agent.console, agent.sandbox
+    if sandbox is None:
+        c.print(
+            "The sandbox is off: shell commands run directly on this machine. Start lcode with --sandbox, or "
+            "turn it on for every session with: lcode config set sandbox docker"
+        )
+        return
+    words = arg.split()
+    if len(words) == 2 and words[0] == "network" and words[1] in ("on", "off"):
+        sandbox.network = words[1] == "on"
+        sandbox.stop()  # the next command starts a container with the new setting
+        c.print(f"Network access in the sandbox is {words[1]} from the next command.")
+        return
+    if arg:
+        c.print("[yellow]Use /sandbox or /sandbox network on|off.[/]")
+        return
+    where = f" · container {sandbox.container}, mounting {sandbox.root}" if sandbox.container else ""
+    c.print(f"Sandbox: {escape(sandbox.describe())}{escape(where)}")
+    c.print(
+        "[dim]Shell commands run in the container and can only see this project; file tools are limited to it "
+        "too. In auto-edit mode, commands run without asking.[/]"
+    )
+
+
 def mcp_command(agent: Agent, arg: str) -> None:
     from lcode.mcp.commands import status_table
     from lcode.mcp.protocol import McpError
@@ -515,6 +546,8 @@ def handle_command(agent: Agent, line: str, hardware: Hardware) -> bool:
         print_checkpoints(agent)
     elif cmd == "/mcp":
         mcp_command(agent, arg)
+    elif cmd == "/sandbox":
+        sandbox_command(agent, arg)
     elif cmd == "/compact":
         agent.compact(arg)
     elif cmd in ("/context", "/ctx"):

lcode/sandbox.py

@@ -0,0 +1,204 @@
+"""An optional sandbox: the model's shell commands run in a container that only sees the project.
+
+One container per session. The project (the git repository around the working directory, or the
+working directory itself) is mounted at the same path, so paths in command output stay valid and
+lcode's file tools, which run on the host, see the same files. Commands run as the host user, with
+no network unless it's allowed, no Linux capabilities, a process limit, and nothing else from the
+host: not the home folder, not the Docker socket.
+
+The default image is built locally on first use from the Dockerfile below. Any image with bash and
+setsid (util-linux or busybox) can be used instead (`sandbox_image`).
+"""
+
+from __future__ import annotations
+
+import hashlib
+import os
+import platform
+import secrets
+import shutil
+import subprocess
+from pathlib import Path
+
+from rich.console import Console
+
+DOCKERFILE = """\
+FROM python:3.12-slim-bookworm
+RUN apt-get update \\
+ && apt-get install -y --no-install-recommends \\
+      git curl ca-certificates build-essential ripgrep jq unzip less procps nodejs npm \\
+ && rm -rf /var/lib/apt/lists/*
+"""
+DEFAULT_IMAGE = f"lcode-sandbox:{hashlib.sha256(DOCKERFILE.encode()).hexdigest()[:12]}"
+LABEL = "dev.lcode.sandbox"
+HOME = "/tmp/lcode-home"
+ENGINES = ("docker", "podman")
+
+
+class SandboxError(Exception):
+    """The sandbox can't be used; the message says how to fix it."""
+
+
+def engine_problem(engine: str) -> str | None:
+    """Why `engine` can't run containers here, or None if it can."""
+    if not shutil.which(engine):
+        if engine == "podman":
+            return "podman isn't installed (https://podman.io/docs/installation)"
+        if platform.system() == "Darwin":
+            return "docker isn't installed: install Docker Desktop, OrbStack or colima"
+        return "docker isn't installed (https://docs.docker.com/engine/install/)"
+    try:
+        r = subprocess.run(
+            [engine, "version", "--format", "{{.Server.Version}}"], capture_output=True, text=True, timeout=20
+        )
+    except (OSError, subprocess.SubprocessError) as e:
+        return f"{engine} doesn't respond: {e}"
+    if r.returncode != 0:
+        detail = (r.stderr.strip().splitlines() or [""])[-1]
+        if "permission denied" in detail.lower():
+            return (
+                f"{engine} needs permission: add yourself to the docker group "
+                "(sudo usermod -aG docker $USER, then log in again)"
+            )
+        if platform.system() == "Darwin":
+            return f"{engine} isn't running: start Docker Desktop, OrbStack or colima ({detail})"
+        return f"{engine} isn't running: start it (sudo systemctl start {engine}) ({detail})"
+    return None
+
+
+def remove_orphans(engine: str) -> None:
+    """Remove sandboxes left behind by lcode sessions that ended without cleaning up."""
+    try:
+        r = subprocess.run(
+            [engine, "ps", "-a", "--filter", f"label={LABEL}", "--format", '{{.ID}} {{.Label "dev.lcode.pid"}}'],
+            capture_output=True,
+            text=True,
+            timeout=20,
+        )
+    except (OSError, subprocess.SubprocessError):
+        return
+    stale = []
+    for line in r.stdout.split("\n"):
+        parts = line.split()
+        if len(parts) == 2 and parts[1].isdigit() and not _alive(int(parts[1])):
+            stale.append(parts[0])
+    if stale:
+        subprocess.run([engine, "rm", "-f", *stale], capture_output=True, timeout=60)
+
+
+def _alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        return True
+    return True
+
+
+class Sandbox:
+    def __init__(self, engine: str, image: str | None = None, network: bool = False, console: Console | None = None):
+        if engine not in ENGINES:
+            raise SandboxError(f"unknown sandbox {engine!r}; use docker or podman")
+        self.engine = engine
+        self.image = image or DEFAULT_IMAGE
+        self.network = network
+        self.console = console or Console()
+        self.container: str | None = None
+        self.root: Path | None = None
+
+    # -- lifecycle
+    def check(self) -> None:
+        problem = engine_problem(self.engine)
+        if problem:
+            raise SandboxError(problem)
+
+    def contains(self, path: Path) -> bool:
+        return self.root is not None and (path == self.root or self.root in path.parents)
+
+    def ensure(self, cwd: Path) -> None:
+        """Have a container running whose mounted folder includes `cwd`."""
+        if self.container and self.contains(cwd):
+            return
+        self.stop()
+        self.check()
+        remove_orphans(self.engine)
+        if self.image == DEFAULT_IMAGE:
+            self._build_default_image()
+        root = project_root(cwd)
+        name = f"lcode-sandbox-{os.getpid()}-{secrets.token_hex(3)}"
+        command = [
+            self.engine, "run", "--detach", "--init", "--name", name,
+            "--label", LABEL, "--label", f"dev.lcode.pid={os.getpid()}",
+            "--cap-drop", "ALL", "--security-opt", "no-new-privileges", "--pids-limit", "1024",
+            "--volume", f"{root}:{root}", "--workdir", str(cwd),
+            "--env", f"HOME={HOME}", "--tmpfs", f"{HOME}:exec,mode=1777",
+        ]  # fmt: skip
+        if not self.network:
+            command += ["--network", "none"]
+        if self.engine == "podman":
+            command += ["--userns", "keep-id"]  # rootless podman: files belong to the host user
+        else:
+            command += ["--user", f"{os.getuid()}:{os.getgid()}"]
+        command += [self.image, "sleep", "infinity"]
+        r = subprocess.run(command, capture_output=True, text=True, timeout=300)
+        if r.returncode != 0:
+            raise SandboxError(f"couldn't start the sandbox: {(r.stderr.strip().splitlines() or ['?'])[-1]}")
+        self.container, self.root = name, root
+
+    def _build_default_image(self) -> None:
+        exists = subprocess.run([self.engine, "image", "inspect", self.image], capture_output=True, timeout=30)
+        if exists.returncode == 0:
+            return
+        with self.console.status("Building the sandbox image (once; a minute or two)…"):
+            r = subprocess.run(
+                [self.engine, "build", "--tag", self.image, "-"],
+                input=DOCKERFILE,
+                capture_output=True,
+                text=True,
+                timeout=1800,
+            )
+        if r.returncode != 0:
+            tail = "\n".join(r.stderr.strip().splitlines()[-5:])
+            raise SandboxError(f"couldn't build the sandbox image:\n{tail}")
+
+    def exec_argv(self, cwd: Path, script: str) -> tuple[list[str], str]:
+        """The command that runs `script` with bash inside the container, and a token for kill()."""
+        assert self.container is not None
+        token = secrets.token_hex(6)
+        # Its own session, so a timeout or Ctrl+C can stop everything the command started.
+        script = f"echo $$ > /tmp/.lcode-{token}.pgid\n{script}"
+        argv = [self.engine, "exec", "--interactive", "--workdir", str(cwd), self.container]
+        return [*argv, "setsid", "--wait", "bash", "-c", script], token
+
+    def kill(self, token: str) -> None:
+        """Stop a command and everything it started (after a timeout or Ctrl+C); the container stays."""
+        if self.container:
+            pgid = f"$(cat /tmp/.lcode-{token}.pgid 2>/dev/null)"
+            subprocess.run(
+                # bash, not sh: dash's kill doesn't accept "--" before a negative (process group) id
+                [self.engine, "exec", self.container, "bash", "-c", f'[ -n "{pgid}" ] && kill -KILL -- -{pgid}'],
+                capture_output=True,
+                timeout=30,
+            )
+
+    def stop(self) -> None:
+        if self.container:
+            subprocess.run([self.engine, "rm", "--force", self.container], capture_output=True, timeout=60)
+        self.container, self.root = None, None
+
+    def describe(self) -> str:
+        image = "lcode's image" if self.image == DEFAULT_IMAGE else self.image
+        network = "network on" if self.network else "no network"
+        return f"{self.engine} · {image} · {network}"
+
+
+def project_root(cwd: Path) -> Path:
+    """The folder the sandbox mounts: the git repository around `cwd`, or `cwd` itself."""
+    from lcode.checkpoints import work_tree_for
+
+    root = work_tree_for(cwd)
+    home = Path.home().resolve()
+    if root == home or root in home.parents or root == Path("/"):
+        raise SandboxError(f"won't mount {root} into the sandbox; start lcode in a project folder")
+    return root

lcode/tools.py

@@ -9,11 +9,10 @@ import json
 import os
 import queue
 import re
-import shlex
+import secrets
 import shutil
 import signal
 import subprocess
-import tempfile
 import threading
 import time
 from pathlib import Path
@@ -25,10 +24,15 @@ from rich.text import Text
 
 from lcode import web
 from lcode.permissions import bash_key, is_read_only
+from lcode.sandbox import SandboxError
 
 if TYPE_CHECKING:
     from lcode.agent import Agent
 
+NO_NETWORK = re.compile(
+    r"Network is unreachable|Temporary failure in name resolution|Could not resolve host|getaddrinfo|ENOTFOUND|"
+    r"EAI_AGAIN|Name or service not known|network is unreachable|No route to host"
+)
 MAX_TOOL_OUTPUT = 30_000  # characters returned to the model per tool call
 IGNORE_DIRS = {
     ".git", "node_modules", "__pycache__", ".venv", "venv", "env", ".mypy_cache", ".pytest_cache",
@@ -277,6 +281,14 @@ class Toolbox:
         p = Path(os.path.expanduser(path or "."))
         return (p if p.is_absolute() else self.agent.cwd / p).resolve()
 
+    def path(self, path: str | None) -> Path:
+        """Resolve a path from the model; with the sandbox on, it must be inside the project."""
+        p = self.resolve(path)
+        root = self.agent.sandbox_root()
+        if root is not None and p != root and root not in p.parents:
+            raise ToolError(f"{path} is outside the project ({root}); with the sandbox on, that's all you can use")
+        return p
+
     def rel(self, p: Path) -> str:
         try:
             return str(p.relative_to(self.agent.cwd)) or "."
@@ -344,7 +356,7 @@ class Toolbox:
 
     # -- read-only
     def t_read_file(self, path: str, offset: int = 1, limit: int = 2000) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.exists():
             raise ToolError(f"{path} does not exist")
         if p.is_dir():
@@ -364,13 +376,13 @@ class Toolbox:
         return truncate(out, 120_000)
 
     def t_list_dir(self, path: str = ".", depth: int = 2) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.is_dir():
             raise ToolError(f"{path} is not a directory")
         return tree(p, depth=max(1, min(int(depth or 2), 6)))
 
     def t_glob(self, pattern: str, path: str = ".") -> str:
-        base = self.resolve(path)
+        base = self.path(path)
         pattern = pattern.removeprefix("./")
         patterns = [pattern] + ([pattern[3:]] if pattern.startswith("**/") else [])
         hits = [
@@ -385,7 +397,7 @@ class Toolbox:
     def t_grep(
         self, pattern: str, path: str = ".", glob: str | None = None, ignore_case: bool = False, context: int = 0
     ) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if shutil.which("rg"):
             cmd = ["rg", "--line-number", "--no-heading", "--with-filename", "--hidden", "--color", "never"]
             cmd += ["--max-columns", "400"]
@@ -450,7 +462,7 @@ class Toolbox:
         self.read_mtimes[str(p)] = p.stat().st_mtime
 
     def t_write_file(self, path: str, content: str) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         exists = p.exists()
         if exists:
             if p.is_dir():
@@ -472,7 +484,7 @@ class Toolbox:
         return f"{'Overwrote' if exists else 'Created'} {self.rel(p)} ({n} lines)."
 
     def t_edit_file(self, path: str, old_string: str, new_string: str, replace_all: bool = False) -> str:
-        p = self.resolve(path)
+        p = self.path(path)
         if not p.exists():
             raise ToolError(f"{path} does not exist (use write_file to create it)")
         self._check_fresh(p)
@@ -515,20 +527,30 @@ class Toolbox:
 
     # -- shell
     def t_bash(self, command: str, timeout: int = 180) -> str:
-        if not is_read_only(command):
+        sandbox = self.agent.sandbox
+        if not is_read_only(command) and not (sandbox and self.agent.perms.mode == "auto-edit"):
             body = Syntax(command, "bash", theme="monokai", word_wrap=True)
-            ok, feedback = self.agent.perms.request(
-                bash_key(command), "bash", f"Run command (in {self.agent.cwd})", body
-            )
+            where = "in the sandbox" if sandbox else f"in {self.agent.cwd}"
+            ok, feedback = self.agent.perms.request(bash_key(command), "bash", f"Run command ({where})", body)
             if not ok:
                 return feedback
+        if not is_read_only(command):
             self.agent.checkpoint()
         self.console.print(Text(f"  $ {command}", style="bold cyan"))
-        fd, cwd_file = tempfile.mkstemp(prefix="lcode_cwd_")
-        os.close(fd)
-        script = f"{command}\n__lcode_ec=$?\npwd -P > {shlex.quote(cwd_file)}\nexit $__lcode_ec\n"
+        marker = f"__lcode_cwd_{secrets.token_hex(8)}__"
+        script = f"{command}\n__lcode_ec=$?\nprintf '\\n{marker}%s\\n' \"$(pwd -P)\"\nexit $__lcode_ec\n"
+        token = ""
+        if sandbox:
+            try:
+                with self.console.status("Starting the sandbox…"):
+                    sandbox.ensure(self.agent.cwd)
+            except SandboxError as e:
+                return f"Error: the sandbox can't start, so the command didn't run: {e}"
+            argv, token = sandbox.exec_argv(self.agent.cwd, script)
+        else:
+            argv = ["bash", "-c", script]
         proc = subprocess.Popen(
-            ["bash", "-c", script],
+            argv,
             cwd=self.agent.cwd,
             stdout=subprocess.PIPE,
             stderr=subprocess.STDOUT,
@@ -546,9 +568,14 @@ class Toolbox:
                 lines.put(line)
             lines.put(None)
 
+        def stop() -> None:
+            if sandbox and token:
+                sandbox.kill(token)  # the command runs in the container, not under our process
+            os.killpg(proc.pid, signal.SIGKILL)
+
         threading.Thread(target=pump, daemon=True).start()
         out: list[str] = []
-        shown, status = 0, ""
+        shown, status, recorded = 0, "", ""
         deadline = time.time() + int(timeout or 180)
         try:
             while True:
@@ -556,30 +583,37 @@ class Toolbox:
                     line = lines.get(timeout=0.2)
                 except queue.Empty:
                     if time.time() > deadline:
-                        os.killpg(proc.pid, signal.SIGKILL)
+                        stop()
                         status = f"\n[Command timed out after {timeout}s and was killed]"
                         break
                     continue
                 if line is None:
                     break
+                if line.startswith(marker):
+                    recorded = line[len(marker) :].strip()
+                    continue
                 out.append(line)
                 if shown <= 40:
                     msg = "    ... (more output hidden)" if shown == 40 else "    " + line.rstrip("\n")[:300]
                     self.console.print(Text(msg, style="dim"))
                     shown += 1
         except KeyboardInterrupt:
-            os.killpg(proc.pid, signal.SIGKILL)
+            stop()
             raise
         code = proc.wait()
-        try:
-            recorded = Path(cwd_file).read_text().strip()
-            if recorded and Path(recorded).is_dir() and Path(recorded).resolve() != self.agent.cwd:
+        if out and out[-1] == "\n":
+            out.pop()  # the blank line printed before the marker
+        if recorded and Path(recorded).is_dir() and Path(recorded).resolve() != self.agent.cwd:
+            if sandbox and not sandbox.contains(Path(recorded).resolve()):
+                status += "\n[That directory is outside the project; the working directory stays the same]"
+            else:
                 self.agent.cwd = Path(recorded).resolve()
                 status += f"\n[Working directory is now {self.agent.cwd}]"
-        except OSError:
-            pass
-        finally:
-            Path(cwd_file).unlink(missing_ok=True)
+        if sandbox and code != 0 and not sandbox.network and NO_NETWORK.search("".join(out[-40:])):
+            status += (
+                "\n[The sandbox has no network access. If this needs the network, ask the user to allow it "
+                "with /sandbox network on]"
+            )
         self.console.print(Text(f"  exit code {code}", style="green" if code == 0 else "red"))
         return truncate("".join(out)) + status + f"\n[exit code: {code}]"
 

{lcode_cli-0.4.1.dist-info → lcode_cli-0.5.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lcode-cli
-Version: 0.4.1
+Version: 0.5.0
 Summary: A local-first terminal coding agent powered by open-weight models on your own GPU or Mac, via Ollama.
 Project-URL: Homepage, https://nasser1941.github.io/lcode/
 Project-URL: Documentation, https://nasser1941.github.io/lcode/
@@ -78,6 +78,8 @@ through [Ollama](https://ollama.com), and when it needs current information it c
   real coding tasks on your machine.
 - **Safe by default.** Every edit is shown as a diff and every command that isn't read-only needs
   your approval. `auto-edit` and `yolo` modes when you want speed.
+- **Sandbox (optional).** `lcode --sandbox` runs the model's shell commands in a container (Docker or
+  Podman) that only sees your project, without network access unless you allow it.
 - **Undo.** lcode saves a checkpoint before the model changes files; `/undo` takes back the last
   request's edits, new files and shell-command changes, without touching your git history.
 - **Bring your own model.** Eight curated open-weight models, all tested end to end, or any Ollama model
@@ -184,7 +186,6 @@ fills up. Details: [How it works](https://nasser1941.github.io/lcode/how-it-work
 
 See the pinned [Roadmap issue](https://github.com/nasser1941/lcode/issues/10). Next up:
 
-- An [optional sandbox for shell commands](https://github.com/nasser1941/lcode/issues/9)
 - More models in the catalog, and test reports from your hardware ([report one](https://github.com/nasser1941/lcode/issues/new?template=model_request.yml))
 
 ## Contributing

{lcode_cli-0.4.1.dist-info → lcode_cli-0.5.0.dist-info}/RECORD

@@ -1,20 +1,21 @@
-lcode/__init__.py,sha256=1t5InCerqpe0xlveEpLyHmEy2nEXzOrj4qbGJyWN6WQ,117
+lcode/__init__.py,sha256=-nk7j2Efg9_MFgFlQo5YWln10lcT6SR31CYBoENbTLo,117
 lcode/__main__.py,sha256=s5N5pryX2FAu93GGZ3FxUrIXHWGzxz66lKUoaV_h8Ws,35
-lcode/agent.py,sha256=dxW07COUQo8UZnIwNfegCOSX_ZStorYsL93jhZFkvN8,27753
+lcode/agent.py,sha256=evwGEJg8zWvA2SnP4yI_vkWba3ILICK9OzVb0cbk6bw,28478
 lcode/bench.py,sha256=FCn94Gs7L8bpq4hzf6ILoQG8dKrbbd5WC4BRwrTp4LM,37950
 lcode/catalog.py,sha256=pZ1azX9OH2r4JE2c6E5OfwywpgS39-W2oXzoCHJhmtM,4141
 lcode/checkpoints.py,sha256=eqPtmPe44-aweWqc2H21ROogwzIt3NpvcUobsaCHoGY,18354
-lcode/cli.py,sha256=ICyUQ1DQmUhy0cNBrRFYvFqyqvLxdcLWn-21-Q6qSWk,25845
-lcode/config.py,sha256=i7EYhhTPaIFxSWyqHiffIEoL4PgHjkBBpF20gc--MtQ,6306
+lcode/cli.py,sha256=iGP5qywc7tUFuLNpzcrlYTicFX6dAaQpeXCfElqxPdQ,27041
+lcode/config.py,sha256=1_dhAwLRZD2rEhD47rBl3W4kvW0lQ6-45TQdq1KHz58,6956
 lcode/hardware.py,sha256=2VbknZCxTZJwJUD8YWdQ7ryEQo_LcjtoOBOHOU9Y0fw,3085
 lcode/limits.py,sha256=oJzVQoMyTZ0_Fkpu5t3qxrf9v7Hv9S8U8BRQR5M1aKA,1237
 lcode/models.toml,sha256=lt2G64zzo_Ryxv2ISRSNZoVD_JqCqYqsM01n8WoXGs8,4098
 lcode/ollama.py,sha256=-EB_8DKh87larG7iV0neyndPRom1Hxh4y8AAfI1Ebq8,6690
 lcode/permissions.py,sha256=OcWUDLrSoohUWHDUQ3UuBE3zI2JnBnOPizLE3bIgqyU,3982
 lcode/render.py,sha256=gMvf4W3qkLUJ4Vot3az_hP_zRDAItJC9pP-68dHFkfA,1375
-lcode/repl.py,sha256=vvKndnzchza2FNkluZTOCJ4qZOF5Dhm-Hhj6N_PfFrI,28814
+lcode/repl.py,sha256=2p6UG1xCmn85YEYcWUtgfoLJc3rHLaGLb_VV-RvzYvw,30332
+lcode/sandbox.py,sha256=u_pkrVRXhCGhh-wFDPwuZ3jGG7UeXxXRAeBNsm37ZvE,8608
 lcode/sessions.py,sha256=wOR-J0EHgJxLSPboKPHnvBcp5VTUYTj3tZWgpsa6-K4,4013
-lcode/tools.py,sha256=fK7OOe6IagBrj9aCF3z4faJTZO3jAamzEPF3AaaH5m0,27234
+lcode/tools.py,sha256=Y23bVt7Bow72v1QJUpvSahoEep77XW8e44Mg-s9igds,29146
 lcode/web.py,sha256=vyxKbSRJTl1Lj3hj7Yd_NwTgbv0Xi6dup2YfUXjqp-Y,14579
 lcode/mcp/__init__.py,sha256=XujtAmRoXW9S0uq1XPf_CAeCkHh_UvA8FCmoAKP9j1Y,171
 lcode/mcp/auth.py,sha256=vyH3oolgIBNJLYabr2h5Soui99NTY1QxjQEgtczfF6A,16655
@@ -27,8 +28,8 @@ lcode/mcp/http.py,sha256=sG9MajwU4_6sqvZhwD4WfyzRKzaR_Lc8C02jwePz18E,7380
 lcode/mcp/manager.py,sha256=UPpY97jwW_KIi2G4hR860Iq4zgfqNFHjsyeu48aEa44,14784
 lcode/mcp/protocol.py,sha256=8uhyzzDQmaXr6pdt9bWD5ccvWZ93rvxd4v3Z5J84vKw,4938
 lcode/mcp/stdio.py,sha256=kC6KHwzMMDjBr-yCZLmyVKS7PZXU299WpZdYRoX5eRQ,6292
-lcode_cli-0.4.1.dist-info/METADATA,sha256=jGUe-zgy_zUWIaqhz9-h6J03eZmXhy9RWwt2BZrgyi0,9869
-lcode_cli-0.4.1.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-lcode_cli-0.4.1.dist-info/entry_points.txt,sha256=pZ_uDQ98UzVAHUQeXn5HeyQWKGSH3r3T5aPHuSB89eI,41
-lcode_cli-0.4.1.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
-lcode_cli-0.4.1.dist-info/RECORD,,
+lcode_cli-0.5.0.dist-info/METADATA,sha256=AKzBZkJaIZLAFgClC2t3OhO36jiVaAAXB7d1EXFEV8Q,9965
+lcode_cli-0.5.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+lcode_cli-0.5.0.dist-info/entry_points.txt,sha256=pZ_uDQ98UzVAHUQeXn5HeyQWKGSH3r3T5aPHuSB89eI,41
+lcode_cli-0.5.0.dist-info/licenses/LICENSE,sha256=JWjmoL7nNIC1XUa-dZm2hwLUgjUQMFo6k8APb0idNzs,1074
+lcode_cli-0.5.0.dist-info/RECORD,,