Merge remote-tracking branch 'origin/main' into cl-10658-pin-bump-bundle-types-bun-oxlintoxfmt-hono-drizzle-safe

# Conflicts:
#	bun.lock

Author: TheGreatAxios

bun.lock

@@ -278,6 +278,22 @@ Provider and model configuration lives in JSON settings files. The global file h
   - `timeoutMs` — default bound when foreground `run_shell` omits `timeout`. Unset keeps the built-in 120000ms default. A positive per-call `timeout` is the bound with no ceiling.
   - `maxTimeoutMs` — clamps that default path only; it does not clamp a per-call override.
 
+  Optional `shell.sandbox` opts shell spawns and stdio MCP servers into an OS-level sandbox via `@anthropic-ai/sandbox-runtime` (path sandboxing on macOS `sandbox-exec`, bubblewrap on Linux). **Default off**; with the sandbox disabled the spawn paths run exactly as before, byte-identical:
+
+  ```json
+  "shell": {
+    "sandbox": {
+      "enabled": true,
+      "network": { "allowedHosts": ["api.github.com", "*.example.com"] }
+    }
+  }
+  ```
+
+  - `enabled` — default **false**. When true, foreground + background `run_shell`, stdio MCP server launches, and lifecycle hooks (discovered under the sandbox-writable session `.corbits/hooks`) wrap into the sandbox: writes are allowed only inside the workspace, the OS tmpdir, and `/tmp/claude`; reads deny the secret-guard denylist classes (`.env*`, `.ssh/`, `.aws/`, key material, credential stores, browser cookie stores, shell history, ...) plus the active `--config` settings path; known provider API-key env vars are unset inside the sandbox. A sandboxed command that cannot be wrapped (missing/broken runtime) **fails closed** — the command never runs — with a `shell sandbox is enabled but unavailable` error; disable the setting to restore raw spawns. Linux additionally needs bubblewrap + socat + ripgrep installed.
+  - `network.allowedHosts` — operator pre-approved domain allowlist (supports `*.wildcards`). Every other host asks through the normal permission gate (auto mode and yolo auto-allow it as they would a `web_fetch`; yolo relaxes the _asks_, never the sandbox itself).
+
+  One sandboxed composition per process: sandbox-runtime's manager is a process-global singleton, so a second `shell.sandbox` composition with a different workspace/allowlist while one is live fails loudly instead of inheriting it. Matching compositions share the singleton by refcount; the last session's teardown resets it.
+
   Optional `tools` block to arm the outer per-tool wall-clock budget (unset leaves the watchdog unarmed):
 
   ```json
@@ -313,14 +329,16 @@ Provider and model configuration lives in JSON settings files. The global file h
 
 All `tools.*` keys live in the global settings file only — there is no per-repo override in `.corbits/settings.json` (unlike `sessionMode`).
 
-| Key                     | Default                                    | Effect                                                                                                                                                 |
-| ----------------------- | ------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
-| `tools.timeoutMs`       | unset (watchdog unarmed)                   | Outer wall-clock budget per tool `run()` when set                                                                                                      |
-| `tools.maxTimeoutMs`    | unset                                      | Cap on the outer budget when set; does not cap a longer requested `run_shell`                                                                          |
-| `tools.waitForApproval` | `true`                                     | Freeze the budget while a permission prompt is open (freeze capped at 30 min); `false` keeps the clock ticking and auto-dismisses the prompt on expiry |
-| `mcp.timeoutMs`         | **300000** (5 min) — armed even when unset | Outer wall-clock budget for `mcp__*` tool calls specifically; capped by `tools.maxTimeoutMs` when set                                                  |
-| `shell.timeoutMs`       | **120000** (2 min) foreground default      | Foreground `run_shell` bound when the call omits `timeout`; background has no default; a per-call `timeout` is the bound with no ceiling               |
-| `shell.maxTimeoutMs`    | unset                                      | Clamps the foreground default path only; does not clamp a per-call `run_shell` timeout                                                                 |
+| Key                                  | Default                                         | Effect                                                                                                                                                 |
+| ------------------------------------ | ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `tools.timeoutMs`                    | unset (watchdog unarmed)                        | Outer wall-clock budget per tool `run()` when set                                                                                                      |
+| `tools.maxTimeoutMs`                 | unset                                           | Cap on the outer budget when set; does not cap a longer requested `run_shell`                                                                          |
+| `tools.waitForApproval`              | `true`                                          | Freeze the budget while a permission prompt is open (freeze capped at 30 min); `false` keeps the clock ticking and auto-dismisses the prompt on expiry |
+| `mcp.timeoutMs`                      | **300000** (5 min) — armed even when unset      | Outer wall-clock budget for `mcp__*` tool calls specifically; capped by `tools.maxTimeoutMs` when set                                                  |
+| `shell.timeoutMs`                    | **120000** (2 min) foreground default           | Foreground `run_shell` bound when the call omits `timeout`; background has no default; a per-call `timeout` is the bound with no ceiling               |
+| `shell.maxTimeoutMs`                 | unset                                           | Clamps the foreground default path only; does not clamp a per-call `run_shell` timeout                                                                 |
+| `shell.sandbox.enabled`              | `false` (opt-in, fail closed on runtime errors) | OS sandbox for `run_shell` and stdio MCP launches via `@anthropic-ai/sandbox-runtime` (workspace+tmp writes, secret denylist reads)                    |
+| `shell.sandbox.network.allowedHosts` | `[]` (every other host asks)                    | Operator pre-approved host allowlist; unmatched hosts ask through the permission gate — yolo auto-allows the ask, the OS sandbox stays on              |
 
 The `waitForApproval` default is resolved once at the watchdog boundary (`resolveWaitForApproval`); toggling **Settings → Tools** updates the live config for the next tool call and persists the value here.
 

docs/IMPLEMENTATION.md

@@ -253,6 +253,39 @@ paths) are verbatim copies of upstream — no modifications. A diff against a
 pristine upstream checkout at the same commit and paths will show 100%
 upstream-authored lines for those eight.
 
+## Bearer correlation IDs and approval provenance
+
+On the approval rail, a correlation ID is a bearer capability. Interchange
+removed the `expectedFrom` sender check upstream, so `tryCorrelate`
+(`vendor/intx-inference/src/reactor.ts`) resolves any inbound message whose
+`interchangeCorrelationId` matches a registered pending operation: a learned
+ID plus a forged `approval.granted` would grant the parked call's one-shot
+bypass, and a forged `approval.denied` would inject a denial into history.
+Upstream's seam for sender authentication is the `CorrelationValidator`
+interface (`vendor/intx-inference/src/correlation.ts`), injected through
+reactor config — but the vendored `@intx/agent` layer forwards no such
+validator into `createReactorAssembly` and its env contract has no field to
+carry one, so production wiring happens on the app side.
+
+Corbits Code therefore authenticates approval provenance at its inbound
+delivery boundary (`src/session/approval-provenance.ts`, wired in
+`src/agent/live-tool-dispatch.ts` around every agent the app constructs):
+typed approvals (`approval.granted` / `approval.denied`) are accepted only
+from the local approval-delivery path — sender `approval@local` on mailbox
+`approval`, the exact provenance `src/session/approval-resume.ts`
+`decisionMessage` stamps — and any other ingress (mailbox or system) is
+discarded with a warn receipt before the reactor can correlate it. The same
+policy is exposed as a `CorrelationValidator` implementation so the vendored
+injection point can consume it verbatim (see
+`e2e/reactor-approval-acceptance.test.ts`) when a vendor seam to forward it
+exists. Decision binding to the gate is untouched and remains in the vendored
+reactor: `tryCorrelate`'s `isLiveApproval` requires the pending operation's
+gate to still hold the correlation ID and be unexpired, and the local
+`reactor-ts-atomic-approval-acceptance` patch keeps a discarded typed
+approval from collapsing the pending operation. The two provenance markers
+and the policy live in one module so the authentic sender cannot drift from
+the allowlist; `decisionMessage` draws its sender/mailbox from that module.
+
 ## Notable upstream shape changes carried by the 2026-08-22 sync
 
 Upstream commit `5f798bea` ("Inject the runtime into iso-git storage")

docs/VENDORING.md

@@ -14,6 +14,7 @@ import {
 } from "../vendor/intx-inference/src/reactor.js";
 import { createDefaultDependencies } from "../vendor/intx-inference/src/providers/index.js";
 import { createSessionOperationQueue } from "../src/tui/delivery-queue.js";
+import { createApprovalCorrelationValidator } from "../src/session/approval-provenance.js";
 
 const call = { id: "parked-call", name: "test_tool", arguments: {} };
 const epoch = 100_000;
@@ -204,6 +205,23 @@ function accepted(h: Awaited<ReturnType<typeof harness>>) {
 function received(h: Awaited<ReturnType<typeof harness>>) {
   return h.events.filter((e) => e.type === "message.received");
 }
+// The operator decision's provenance markers, exactly as the local
+// approval-delivery path (src/session/approval-resume.ts decisionMessage)
+// stamps them.
+function operatorDecision(
+  outcome: "approved" | "rejected" = "approved",
+): InboundMessage {
+  const message = createInboundMessage({
+    from: "approval@local",
+    to: "agent@local",
+    correlationId: "approval",
+    content: JSON.stringify({ outcome }),
+    ref: { mailbox: "approval" },
+  });
+  message.headers.interchangeType =
+    outcome === "approved" ? "approval.granted" : "approval.denied";
+  return message;
+}
 function resumes(h: Awaited<ReturnType<typeof harness>>) {
   return h.directed.filter(
     (e) => e.type === "resume.execute_tools" || e.type === "resume.tool_result",
@@ -519,3 +537,28 @@ describe("atomic typed approval acceptance", () => {
     expect(JSON.stringify(h.snapshots.at(-1)?.turns)).toContain("approved");
   });
 });
+
+// Foreign-from/mailbox ingress repro (CL-10678): a typed approval whose ID
+// matches a live pending operation but whose sender is not the local
+// approval-delivery path must be discarded, then a real local decision must
+// still succeed against the same pending operation.
+describe("approval provenance on typed approvals", () => {
+  test("foreign ingress with a live correlation id is discarded and the real operator approval still succeeds", async () => {
+    const h = await harness({
+      validator: createApprovalCorrelationValidator(),
+    });
+    // Forgery probe: valid correlation id, foreign sender, mailbox ingress.
+    h.reactor.deliver(decision());
+    await drain();
+    expectDiscard(h);
+    expect(resumes(h)).toHaveLength(0);
+    // The real operator decision must still land after the probe.
+    h.reactor.deliver(operatorDecision());
+    await drain();
+    expect(accepted(h)).toHaveLength(1);
+    expect(received(h)).toHaveLength(0);
+    expect(h.grants).toHaveLength(1);
+    expect(h.tools).toHaveLength(1);
+    expect(resumes(h)).toHaveLength(1);
+  });
+});

e2e/reactor-approval-acceptance.test.ts

@@ -82,10 +82,10 @@
     "hono": "^4.11.9",
     "isomorphic-git": "^1.27.2",
     "semver": "^7.7.2",
-    "ssri": "^12.0.0",
     "tar": "^7.5.1"
   },
   "dependencies": {
+    "@anthropic-ai/sandbox-runtime": "0.0.79",
     "@corbits/codex-provider": "0.1.1",
     "@corbits/oauth-core": "0.2.0",
     "@corbits/openai-responses": "0.2.1",

package.json

@@ -1202,6 +1202,21 @@ describe("handoff arming (/handoff)", () => {
     ).toBeNull();
   });
 
+  test("a failed handoff compact does not schedule the post-compact infer", () => {
+    const governor = createCompactionGovernor(undefined);
+    governor.syncFromTurns(tenTurns);
+    expect(governor.requestHandoff("now do the UI audit")).toBe("armed");
+    const actions = governor.interceptIdleContinuation(
+      pivot("now do the UI audit"),
+      capabilities,
+    );
+    expect(actions?.some((a) => a.type === "compact")).toBe(true);
+    expect(governor.hasOutstandingContinuation()).toBe(true);
+    governor.noteKeptPrior();
+    expect(governor.hasOutstandingContinuation()).toBe(false);
+    expect(governor.resumeAfterCompact(emptyMessage())).toBeNull();
+  });
+
   test("instructions stay sticky for the summary after the fold fires", () => {
     const governor = createCompactionGovernor(undefined);
     governor.syncFromTurns(tenTurns);