feat: replace tool permissions with session sandbox boundaries - #1581

Merged

Astro-Han merged 162 commits into

mainfrom

feat/1564-session-sandbox-boundary

Jul 29, 2026

Commits on Jul 29, 2026

feat: allow workspace metadata writes in auto sandbox
Astro-Han
committed
30f3d42
feat: define session sandbox boundary contracts
Astro-Han
committed
82dcdad
feat: persist session sandbox boundaries atomically
Astro-Han
committed
3dadf5f
feat: request session sandbox boundary expansion
Astro-Han
committed
ec31288
feat: report required sandbox boundary expansion
Astro-Han
committed
d3aa071
feat: present session sandbox boundary controls
Astro-Han
committed
ba5b41f
feat: make non-interactive runs fail closed
Astro-Han
committed
229f33d
feat: enforce sandbox boundaries in builtin tools
Astro-Han
committed
95b2103
refactor: remove generic tool authorization gate
Astro-Han
committed
5da00bb
refactor: detach the AI backend from permission review
Astro-Han
committed
7494b8a
refactor: remove per-tool permission metadata
Astro-Han
committed
3c2ceff
refactor: remove one-call sandbox authority
Astro-Han
committed
d1d5fd2
refactor: remove generic permission frames from Pi backend
Astro-Han
committed
a4ad572
refactor: own path normalization in sandbox boundary
Astro-Han
committed
a25cf39
refactor: remove desktop tool permission metadata
Astro-Han
committed
74508d7
refactor: remove desktop permission engine singleton
Astro-Han
committed
95d9a8b
refactor: remove headless permission engine wiring
Astro-Han
committed
6216502
feat: catalog the sandbox boundary request tool
Astro-Han
committed
8403ea2
refactor: remove CLI permission engine wiring
Astro-Han
committed
98542cd
refactor: remove AI backend permission inputs
Astro-Han
committed
a2c41d9
refactor: remove ToolRuntime permission dependency
Astro-Han
committed
a8ec26b
refactor: delete legacy permission engine implementation
Astro-Han
committed
51e6dae
refactor: dedicate sandbox boundary response API
Astro-Han
committed
cd058e8
refactor: narrow hosted interactions to user questions
Astro-Han
committed
a03c31e
refactor: remove legacy non-interactive permission handling
Astro-Han
committed
fb4f5ef
refactor: route desktop interactions through sandbox boundaries
Astro-Han
committed
d3a210a
refactor: delete legacy desktop permission prompt
Astro-Han
committed
4d7b899
refactor: retire legacy permission prompt styles
Astro-Han
committed
7a93414
feat: localize sandbox boundary prompts
Astro-Han
committed
bf51fd4
test: cover desktop sandbox boundary takeover
Astro-Han
committed
6cbf999
test: add sandbox boundary prompt stories
Astro-Han
committed
2d99c72
refactor: remove live generic permission projection
Astro-Han
committed
197a703
refactor: narrow CLI sandbox boundary responses
Astro-Han
committed
e0189f9
refactor: remove generic TUI permission prompts
Astro-Han
committed
85eb82c
feat: expose only Auto and Bypass in TUI
Astro-Han
committed
092a93f
refactor: remove legacy modes from command palette
Astro-Han
committed
714bda4
test: recover legacy pending permission interactions
Astro-Han
committed
39b8c8b
refactor: retire live legacy permission events
Astro-Han
committed
afb87ae
refactor: track sandbox boundary session status
Astro-Han
committed
c2dfc42
test: replace desktop permission handoff fixture
Astro-Han
committed
7ed4d84
refactor: delete legacy permission prompt copy
Astro-Han
committed
4309ac1
docs: describe the two boundary modes
Astro-Han
committed
ec1bd77
refactor: remove headless permission intervention
Astro-Han
committed
3117c58
refactor: remove headless permission grant ingress
Astro-Han
committed
8e00fe7
fix: point AHE policy evidence at sandbox boundaries
Astro-Han
committed
d2ff33b
refactor: delete headless permission grant helpers
Astro-Han
committed
d627422
refactor: remove legacy permission continuity hooks
Astro-Han
committed
6d58399
refactor: project sandbox boundary session status
Astro-Han
committed
1a6af27
refactor: resume runs from sandbox boundary decisions
Astro-Han
committed
ee2c13c
refactor: delete the permission policy matrix
Astro-Han
committed
0fb2161
refactor: delete permission prompt health helpers
Astro-Han
committed
141ae3c
refactor: remove permission decisions from live run outcomes
Astro-Han
committed
ed039f5
refactor: retire permission handoff lifecycle semantics
Astro-Han
committed
9a827d4
refactor: remove headless permission handoff helper
Astro-Han
committed
8cbe44e
refactor: retire desktop permission handoff semantics
Astro-Han
committed
a6318f7
refactor: terminalize legacy permission handoffs in UI
Astro-Han
committed
69972a8
docs: name filesystem operation boundaries accurately
Astro-Han
committed
038a8bf
test: expect managed boundary expansion failures
Astro-Han
committed
d312be7
docs: describe runtime boundary authority
Astro-Han
committed
5eb5c6d
docs: align skill declarations with sandbox boundaries
Astro-Han
committed
19f5771
docs: bind local memory to the session boundary
Astro-Han
committed
6611109
style: format sandbox boundary tests
Astro-Han
committed
19a3ea7
test: assert sandbox boundary skill guidance
Astro-Han
committed
ee09257
test: allow workspace metadata through seatbelt
Astro-Han
committed
c21d47a
test: keep workspace metadata writable on Linux
Astro-Han
committed
26ad704
test: exercise expanded macOS session boundaries
Astro-Han
committed
08f1d6e
test: scope Linux metadata guards to guarded profiles
Astro-Han
committed
69e67fe
fix: fail closed on sandbox boundary failures
Astro-Han
committed
a0a8d8f
style: govern sandbox boundary prompt typography
Astro-Han
committed
8c4bb13
feat: localize sandbox bypass confirmation
Astro-Han
committed
fabedca
test: assert session sandbox mode transitions
Astro-Han
committed
07b518e
test: assert sandbox boundary skill authority
Astro-Han
committed
73cda36
docs: trace sandbox boundary prompt stories
Astro-Han
committed
d7ceddf
refactor: remove unused checkbox primitive
Astro-Han
committed
b8b66fa
test: decouple daily review from permission source order
Astro-Han
committed
cc6d13f
test: adapt main runtime fixtures to sandbox boundaries
Astro-Han
committed
a88197e
test: adapt hosted failure backend to sandbox boundaries
Astro-Han
committed
1b0e6f8
test: publish hosted questions before closure
Astro-Han
committed
873862e
fix(core): make sandbox boundary expansion exact
Astro-Han
committed
1a0dc55
fix: make session boundaries the live permission authority
Astro-Han
committed
0caeec9
fix: persist inherited and external boundaries
Astro-Han
committed
6bbe1ee
fix(runtime): fail closed on sandbox capability gaps
Astro-Han
committed
5deef91
fix(runtime): retire one-call sandbox escalation guidance
Astro-Han
committed
8659bda
fix(cli): require yolo to resume bypass sessions
Astro-Han
committed
0d90b64
fix(runtime): route boundary responses to their owner
Astro-Han
committed
22e7152
fix(cli): present session boundaries in the TUI
Astro-Han
committed
dc0d60b
test(runtime): align Linux sandbox smoke with workspace writes
Astro-Han
committed
46f4212
test(storage): race boundary approvals across connections
Astro-Han
committed
0b1d2ee
fix(desktop): display and confirm authoritative boundaries
Astro-Han
committed
b7b05c8
fix(desktop): recover sandbox boundary prompts safely
Astro-Han
committed
8f2217f
fix: narrow boundary decisions to their new contract
Astro-Han
committed
bd1e619
fix(desktop): keep session boundaries independent of defaults
Astro-Han
committed
d64ab96
refactor(runtime): remove retired sandbox permission metadata
Astro-Han
committed
8cf6f23
fix(desktop): describe the authoritative boundary model
Astro-Han
committed
c357878
test(desktop): complete the boundary approval journey
Astro-Han
committed
fc102ec
test(storage): migrate legacy session boundaries durably
Astro-Han
committed
2dbdd25
fix(runtime): settle boundary prompts when turns close
Astro-Han
committed
fb7dc6e
fix(cli): seed noninteractive sessions as Auto
Astro-Han
committed
9872333
fix(headless): make external boundaries authoritative
Astro-Han
committed
530fa38
fix(storage): preserve boundaries in session bundles
Astro-Han
committed
ff640f0
fix(storage): apply SQLite busy timeout before WAL setup
Astro-Han
committed
1c18780
test(desktop): model bot boundary repinning
Astro-Han
committed
aa40649
test(ui): annotate the maximum boundary story
Astro-Han
committed
9612f22
test(runtime): expect Linux boundary expansion diagnostics
Astro-Han
committed
3495fb4
refactor: align effective tool surfaces with boundaries
Astro-Han
committed
5baed02
fix: stop using legacy modes for runtime admission
Astro-Han
committed
7d49213
fix: reject external sessions on local surfaces
Astro-Han
committed
18354d2
fix(runtime): fail closed without filesystem sandbox
Astro-Han
committed
f540142
fix(runtime): revoke shell authority on boundary narrowing
Astro-Han
committed
a494107
fix(desktop): keep deep research read only
Astro-Han
committed
0918050
feat(runtime): declare Bash sandbox capabilities
Astro-Han
committed
1c8a9b1
fix(cli): fail closed on unresolved sandbox boundaries
Astro-Han
committed
ea26941
fix(runtime): preserve committed boundary transitions
Astro-Han
committed
5139d4c
fix(runtime): close sandbox request lifecycle races
Astro-Han
committed
d27f84c
fix(desktop): reconcile boundary prompt hydration
Astro-Han
committed
11ac2de
fix(storage): snapshot session boundary exports atomically
Astro-Han
committed
1f363d8
fix(core): honor sandbox deny and special roots
Astro-Han
committed
1bb5c7a
fix: update harnesses for boundary authority
Astro-Han
committed
9f0abe3
refactor(runtime): use explicit child tool allowlists
Astro-Han
committed
065f351
refactor(core): retire additional permission mutation APIs
Astro-Han
committed
3bf5751
fix: clarify bypass confirmation risk
Astro-Han
committed
1d7e37e
refactor(runtime): remove legacy boundary fallback
Astro-Han
committed
6f1edbe
test(desktop): pin read-only research tool scoping
Astro-Han
committed
9e59a3b
fix(desktop): hydrate boundary takeover fixtures authoritatively
Astro-Han
committed
5cf87a8
refactor(runtime): require explicit boundary authority
Astro-Han
committed
99ec46a
fix(desktop): keep external sessions non-interactive
Astro-Han
committed
c4cba1a
fix(runtime): route managed execution by boundary
Astro-Han
committed
c28d8fc
fix(runtime): revoke shells on managed narrowing
Astro-Han
committed
67b973b
fix(storage): restore Auto authority after Explore
Astro-Han
committed
f1e6733
fix(storage): preserve boundaries in legacy exports
Astro-Han
committed
7592165
fix(desktop): centralize external execution admission
Astro-Han
committed
ed93d09
refactor(runtime): retire legacy child mode admission
Astro-Han
committed
65e79e4
fix: prevent repeated boundary prompt responses
Astro-Han
committed
cd4f0e9
fix(cli): accumulate descendant boundary failures
Astro-Han
committed
e29db97
fix(runtime): prepare only declared exact write targets
Astro-Han
committed
502da8a
test(runtime): align linked child mode contract
Astro-Han
committed
cb1302d
fix(runtime): reject stale linked child boundaries
Astro-Han
committed
e90de07
fix(core): round-trip protected sandbox metadata
Astro-Han
committed
1e72633
fix(runtime): reject non-managed worker boundaries
Astro-Han
committed
2df679e
test(runtime): reconcile provider fixtures after rebase
Astro-Han
committed
97d3d5e
fix(core): preserve protected metadata denies
Astro-Han
committed
4d37df6
fix(runtime): canonicalize enforceable boundary paths
Astro-Han
committed
0cf0370
fix(desktop): guard resumed external plans
Astro-Han
committed
f5c6f61
fix(cli): give boundary prompts input ownership
Astro-Han
committed
708509e
fix(cli): accept safe boundary recovery
Astro-Han
committed
5780192
fix(storage): restore unnamed managed profiles
Astro-Han
committed
4296c89
fix(storage): align boundary transfer capacity
Astro-Han
committed
b22056d
fix: retire subagent permission ceilings
Astro-Han
committed
d44ab98
fix(runtime): revoke descendant boundary authority
Astro-Han
committed
2cc6a4b
fix(desktop): admit startup boundary resumes
Astro-Han
committed
67092fd
fix(runtime): pin Linux sandbox mount roots
Astro-Han
committed
50fea20
fix(cli): keep boundary failures fail-closed
Astro-Han
committed
42fa080
fix(storage): bound cumulative execution authority
Astro-Han
committed
2e4830e
fix(storage): require boundaries in legacy exports
Astro-Han
committed
3949ae4
fix(storage): make Auto restoration total
Astro-Han
committed
273ec57
refactor(core): own boundary containment semantics
Astro-Han
committed
e7f33b5
test(desktop): exercise execution IPC admission
Astro-Han
committed
a67a831
test(desktop): scan extracted execution IPC
Astro-Han
committed
1d512cf
fix(runtime): pin filesystem worker targets on Linux
Astro-Han
committed
c397bad
fix(runtime): pin dynamic Linux mount roots
Astro-Han
committed
c414fbf
fix(cli): accept boundary-safe run recovery
Astro-Han
committed
3c68d92
fix(runtime): preserve boundaries in conversation copies
Astro-Han
committed
6b82f24