fix(security): wire the permission bridge, sandbox, and worktree preservation into production

[vimoxshah]

Three statements the project makes in public did not match the code. Each gap was a missing call site in front of working, tested code. ADR-034 records the decision; this PR is the wiring plus guards that read the sources, so the call sites cannot silently disappear again.

What was wrong

• Approvals never fired. The docs say a gated tool call holds until a human answers. onPermissionRequest was called only by mock-runner.ts, so no production run ever raised one.
• The sandbox was never applied. The Seatbelt profile generator, symlink resolution, credential-collision refusal, and the 13-check escape suite were all real and passing, but no production spawn passed a spec to the engine.
• Interrupted worktrees were deleted. S-39 pruned a worktree whenever the agent had committed nothing, which includes a run killed by timeout, despite the docs promising the work is preserved.

What changed

• The Claude CLI engine raises every gated tool call through a loopback HTTP MCP bridge and holds for the run's remaining wall-clock budget, not a fixed window. --permission-prompt-tool is present in CLI 2.1.261, which falsifies ADR-020's premise. The contract matrix was re-run against the installed version to prove it.
• Every engine spawn routes through applySandbox(). CW_SANDBOX=off is the only way out, and it is logged, written to the safety journal, and stamped on the report.
• Worktree pruning is limited to runs that ended cleanly with no git operation in flight. Otherwise the worktree is kept and the report says why.
• Under acceptEdits the CLI runs Bash without consulting the prompt tool, so the deny-list floor moved to a PreToolUse hook, which the CLI invokes in every permission mode.

Testing

Suite green: 260 passed across 37 files. Lint and typecheck clean.

The cancel test was also made deterministic. The daemon marks a run running at spawn, before the child has executed a line, so cancelling on that signal alone raced the child's first message and sandboxed was legitimately null. The test now waits for the containment stamp before interrupting. That is a test-only change; sandboxedFor semantics are untouched.

Note for the reviewer

A stacked PR with the agent-workforce features is based on this branch. Merge this one first, then that one retargets to main.

🤖 Generated with Claude Code

[vimoxshah]

Addendum, f3b0654 — hardens the floor hook's deny path (stderr flushed before exit(2); the deny itself was never at risk) and lands the docs that describe what ships: ADR-035, the closed "Known gap" in docs/security.md, the README floor bullet, and the T-007 "floor closed" row.

Floor proven end to end through the production runner-child, 2026-09-06 (CLI 2.1.261, acceptEdits):

• sandbox enabled=true v2 at 0.3s
• npm view left-pad version → permission raised at 29.7s, held 8s, allowed, executed inside the profile (bridge intact)
• git push --force origin main → floor at 95.8s: "force-push to protected branch 'main' is blocked by global deny-list"; never executed; recorded as policy_deny + deny_list_hit
• echo done ran; outcome completed, exit 0
• Hook cost: 60 ms median per Bash call (10 allow calls 55–72 ms; deny 59 ms with the full reason on stderr)

In-sandbox engine probes (production applySandbox wrap): OpenCode, Hermes (TERMINAL_CWD) and Codex (-s danger-full-access under our profile — macOS refuses to nest a Seatbelt inside a deny-default one, every allow bisected) each wrote ok.txt in the worktree; /tmp escape denied; ~/.zsh_history read denied.

Release worktree at this head: typecheck 0 · runner 116/116 · daemon 127/127 · UI build 0.

Surfaced, not decided: LICENSE §12's audit set should list permission-server.ts and floor-hook.ts; runs inherit HOME so a developer's permissions.allow rules and SessionStart/SessionEnd hooks apply unattended (the floor hook holds regardless).

[vimoxshah]

Review outcome and fixes (067dda2, 9bb01b4). An Opus read-only pass on the whole branch diff initially refuted it on two findings, both reproduced on this machine; both are now closed and re-verified by the same reviewer (VERIFIED WITH CAVEATS, caveats folded in).

1. Floor bypass via repo settings — closed. A repo committing {"disableAllHooks": true} in .claude/settings.json switched the PreToolUse floor hook off; under acceptEdits a floor-listed command ran unasked while the report still said sandboxed: true. The --settings payload now pins disableAllHooks: false (CLI-flag settings outrank project settings). Re-probed on CLI 2.1.261 against the strongest hostile combination the bundle offers (disableAllHooks, allowManagedHooksOnly, hooksDisabled, an empty hooks.PreToolUse, plus settings.local.json): hook fired, command blocked. Unit test pins the key.
2. BYOK key readable through the exec-time env — closed for keychain configs. Deleting CW_BYOK_KEY from process.env was not a boundary: macOS keeps a process's exec-time env readable via sysctl KERN_PROCARGS2, and the profile must allow sysctl-read. The credential now travels over the daemon⇄child stdin pipe as a credential message, only for BYOK runs; the env never contains it. Verified on the built child: explicit empty message fails in 0.1 s, silence fails at 15.1 s, same auth text. Caveat documented: auth: 'env' configs keep the key in the daemon's own exec-time env by construction; keychain-backed configs are fully closed.

Also from review: codex/opencode/hermes/api-agent runners now remove their per-run cw-sb-* profile dir on close/error/spawn-failure (the API agent leaked one per tool call) and the three CLI runners gained the child error handler they lacked; the hook watchdog marks itself final; docs/security.md names the remaining gaps (Bash-only matcher vs repo-declared MCP servers; no bearer token on the loopback bridge yet); ADR-035 records everything.

Reviewer's own re-run on this checkout: 39 files, 271/271. Mine: typecheck 0, build 0, runner 124/124, daemon 130/130; production floor E2E passed again on the final dist.