Replaces the sandbox.enabled boolean with per-role sandbox.profile choices (off, relaxed, strict): stamped workers default to relaxed, heads/standalone/unstamped sessions to off. Projects may only harden a profile (off < relaxed < strict). Role profiles are selected by daemon-stamped first-party trust; untrusted/MCP/unverified routes are always strict or refused, and an mcp: client claim keeps strict even on a mis-stamped first-party route.
macOS relaxed is a default-allow Seatbelt deny list that preserves ordinary caches, sockets, browsers, toolchains and compile servers while protecting credentials, configuration and configured tool homes. Environment-derived credential denies resolve existing paths and their deepest ancestors, skipping unresolvable inputs with warnings instead of refusing the shell; denies survive renaming any enclosing directory, and nested checkout denies guard ancestor unlink so protected sibling checkouts cannot be relocated while scoped own-checkout writes stay allowed. strict keeps the existing jail. Linux relaxed publishes its denies as unenforced because Landlock cannot subtract paths from a default-allow grant. Windows relaxed runs unconfined and reports every deny as unenforced; Windows strict refuses. Relaxed shells run with the same credential-stripped child environment as strict and, like off, keep shell permission asks instead of deferring approval to the spawn plan.
Harness sandbox roles merge as raw choices before project/user hardening. sandbox.enabled is retired and translated automatically: true becomes strict for both roles, false becomes relaxed worker / off head.
Confidence Score: 5/5
The PR appears safe to merge; no new actionable issue was established.
Summary
Replaces sandbox.enabled with per-role off, relaxed, and strict profiles.
Shell profiles follow each session's role and trust.
Relaxed shells keep broad access while reporting their protected-path limits.
Old sandbox booleans map into role profiles when configuration loads.
Diagram
%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[Shell request] --> B{Requires strict trust policy?}
B -->|Yes| S[Strict]
B -->|No| R{Authenticated worker?}
R -->|Yes| W[Worker profile]
R -->|No| H[Head profile]
W --> P[Resolved profile]
H --> P
S --> P
P --> O{Profile}
O -->|Off| U[No OS restrictions]
O -->|Relaxed| L[macOS denies; Linux and Windows warn]
O -->|Strict| C[Native containment or refusal]
