a205ba4c29
`bounds the default probes` runs a real launcher that sleeps 1s under the 5000ms default probe budget, all wrapped in vitest's 5000ms default test timeout. The blocking spawnSync races that wrapper and tips over under the load spike of a full parallel run — a pre-existing, load-sensitive flake (noted as unrelated in this PR's original description). Give the test an explicit 20s timeout so its bounded subprocess work never races the default.
sandbox/ — process-sandbox capability family
The confinement half of the capability-seam split: an abstract provider interface, platform backends, and the shared policy home. Consumers hand ctx.sandbox the exact argv they are about to spawn and spawn the returned (wrapped) argv instead; policy (SandboxPolicy: mode + workspace root) rides each call, so different consumers confine under different policies at the same instant. All product packages.
| Package | Role | ctx key |
|---|---|---|
sandbox/ |
Abstract process-sandbox seam (the SandboxProvider contract + the mode/enforcement/policy vocabulary) plus the shared ESCALATION kit (approveEscalation, the strictly-wider ladder, the denial/hint markers) and the writableRoots derivation every enforcement dialect shares |
ctx.sandbox |
sandbox-local/ |
Local backends by platform chain: Linux bwrap else the landlock-run launcher (the npm-distributed node-addon-landlock-run family, built and released from its own repository), darwin sandbox-exec/Seatbelt — multi-candidate chains functionally probed, sole candidates selected directly, verdict cached, fail-closed |
(registers ctx.sandbox) |
sandbox-policy/ |
The policy home: the deployment default (mode + workspace-write boundary root) and the per-session sandbox/mode override (event + fold + write path). Both enforcing families read it, so bash and fs can never confine to different roots |
ctx.sandboxPolicy |
The seam confines SAME-WORLD subprocesses only (shared filesystem and kernel). Containers, microVMs, and remote executors are NOT backends here — they replace whole capability implementations (ctx.bash, ctx.fs) as environment-coherent groups; the boundary is recorded in the sandbox Agent Note.
Consumers today: bash/bash-sandbox (wraps ['bash', '-c', command] through ctx.sandbox) and fs/fs-sandbox (an in-process path fence, not an argv wrapper — reads ctx.sandboxPolicy and enforces the shared mode on write/edit). The cross-family boundary is the sandbox Agent Note's cross-family fs sandbox phase; the shared vocabulary lets both families teach the model one denial marker and one escalation flow.