imjasonh · Mar 20, 2026 · Mar 20, 2026
diff --git a/.claude/settings.json b/.claude/settings.json
@@ -0,0 +1,14 @@
+  {
+    "hooks": {
+      "Stop": [
+        {
+          "hooks": [
+            {
+              "type": "command",
+              "command": "afplay /System/Library/Sounds/Hero.aiff"
+            }
+          ]
+        }
+      ]
+    }
+  }
diff --git a/.github/actions/push-sandbox/action.yml b/.github/actions/push-sandbox/action.yml
@@ -58,8 +58,8 @@ runs:
       id: 'image_tag'
       shell: 'bash'
       run: |-
-        SHELL_TAG_NAME="${INPUTS_GITHUB_REF_NAME}"
-        FINAL_TAG="${INPUTS_GITHUB_SHA}"
+        SHELL_TAG_NAME="${{ inputs.github-ref-name }}"
+        FINAL_TAG="${{ inputs.github-sha }}"
         if [[ "$SHELL_TAG_NAME" =~ ^v[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.-]+)?$ ]]; then
           echo "Release detected."
           FINAL_TAG="${SHELL_TAG_NAME#v}"
@@ -68,43 +68,30 @@ runs:
         fi
         echo "Determined image tag: $FINAL_TAG"
         echo "FINAL_TAG=$FINAL_TAG" >> $GITHUB_OUTPUT
-      env:
-        INPUTS_GITHUB_REF_NAME: '${{ inputs.github-ref-name }}'
-        INPUTS_GITHUB_SHA: '${{ inputs.github-sha }}'
-    # We build amd64 just so we can verify it.
-    # We build and push both amd64 and arm64 in the publish step.
-    - name: 'build'
-      id: 'docker_build'
+    - name: 'pack tarballs'
       shell: 'bash'
       env:
-        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
         GEMINI_SANDBOX: 'docker'
-        BUILD_SANDBOX_FLAGS: '--platform linux/amd64 --load'
-        STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
-      run: |-
-        npm run build:sandbox -- \
-          --image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}" \
-          --output-file final_image_uri.txt
-        echo "uri=$(cat final_image_uri.txt)" >> $GITHUB_OUTPUT
-    - name: 'verify'
+      run: 'npm run build:sandbox -- --pack-only -s'
+    - name: 'build and push multi-arch image'
       shell: 'bash'
+      if: "${{ inputs.dry-run != 'true' }}"
       run: |-
-        docker run --rm --entrypoint sh "${{ steps.docker_build.outputs.uri }}" -lc '
-          set -e
-          node -e "const fs=require(\"node:fs\"); JSON.parse(fs.readFileSync(\"/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli/package.json\",\"utf8\")); JSON.parse(fs.readFileSync(\"/usr/local/share/npm-global/lib/node_modules/@google/gemini-cli-core/package.json\",\"utf8\"));"
-          /usr/local/share/npm-global/bin/gemini --version >/dev/null
-        '
-    - name: 'publish'
+        docker buildx build \
+          --platform linux/amd64,linux/arm64 \
+          --build-arg CLI_VERSION_ARG=$(jq -r .version package.json) \
+          -t google/gemini-cli-sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \
+          --push \
+          .
+    - name: 'build multi-arch image (dry run)'
       shell: 'bash'
-      if: "${{ inputs.dry-run != 'true' }}"
-      env:
-        GEMINI_SANDBOX_IMAGE_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
-        GEMINI_SANDBOX: 'docker'
-        BUILD_SANDBOX_FLAGS: '--platform linux/amd64,linux/arm64 --push'
-        STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG: '${{ steps.image_tag.outputs.FINAL_TAG }}'
+      if: "${{ inputs.dry-run == 'true' }}"
       run: |-
-        npm run build:sandbox -- \
-          --image "google/gemini-cli-sandbox:${STEPS_IMAGE_TAG_OUTPUTS_FINAL_TAG}"
+        docker buildx build \
+          --platform linux/amd64,linux/arm64 \
+          --build-arg CLI_VERSION_ARG=$(jq -r .version package.json) \
+          -t google/gemini-cli-sandbox:${{ steps.image_tag.outputs.FINAL_TAG }} \
+          .
     - name: 'Create issue on failure'
       if: |-
         ${{ failure() }}

diff --git a/.github/workflows/test-sandbox.yml b/.github/workflows/test-sandbox.yml
@@ -0,0 +1,152 @@
+name: 'Testing: Sandbox Modes'
+
+on:
+  push:
+    branches:
+      - 'main'
+      - 'release/*'
+  pull_request:
+    branches:
+      - 'main'
+  workflow_dispatch:
+
+concurrency:
+  group: '${{ github.workflow }}-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+permissions:
+  contents: 'read'
+
+jobs:
+  test-sandbox:
+    name: 'Sandbox (${{ matrix.sandbox }} ${{ matrix.os }})'
+    runs-on: '${{ matrix.os }}'
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - sandbox: 'bwrap'
+            os: 'ubuntu-latest'
+          - sandbox: 'landlock'
+            os: 'ubuntu-latest'
+          - sandbox: 'landlock'
+            os: 'ubuntu-24.04-arm'
+          - sandbox: 'sandbox-exec'
+            os: 'macos-latest'
+          # macos-container requires Apple's Virtualization.framework, which is
+          # unavailable on GHA runners (no nested VZ in ARM64 VMs).
+          # Both `container build` and `container run` fail. Test locally only.
+          - sandbox: 'docker'
+            os: 'ubuntu-latest'
+          - sandbox: 'bwrap'
+            os: 'windows-2025'
+
+    defaults:
+      run:
+        shell: "${{ contains(matrix.os, 'windows') && 'wsl-bash {0}' || 'bash' }}"
+
+    steps:
+      - name: 'Checkout'
+        uses: 'actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8' # ratchet:actions/checkout@v5
+
+      - name: 'Setup WSL2'
+        if: "runner.os == 'Windows'"
+        uses: 'Vampire/setup-wsl@6a8db447be7ed35f2f499c02c6e60ff77ef11278' # ratchet:Vampire/setup-wsl@v6
+        with:
+          distribution: 'Ubuntu-24.04'
+          additional-packages: 'bubblewrap build-essential'
+
+      - name: 'Install Node.js 20 in WSL'
+        if: "runner.os == 'Windows'"
+        run: |
+          curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
+          sudo apt-get install -y nodejs
+
+      - name: 'Set up Node.js 20.x'
+        if: "runner.os != 'Windows'"
+        uses: 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020' # ratchet:actions/setup-node@v4
+        with:
+          node-version: '20.x'
+
+      - name: 'Enable unprivileged user namespaces (bwrap)'
+        if: "matrix.sandbox == 'bwrap' && runner.os != 'Windows'"
+        run: |
+          # Ubuntu 24.04 restricts unprivileged user namespaces via AppArmor.
+          # bwrap needs them to set up uid/gid maps.
+          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 2>/dev/null \
+            || sudo sysctl -w kernel.unprivileged_userns_clone=1 2>/dev/null \
+            || { echo "::error::Could not enable unprivileged user namespaces"; exit 1; }
+
+      - name: 'Install bubblewrap'
+        if: "matrix.sandbox == 'bwrap' && runner.os != 'Windows'"
+        run: 'sudo apt-get install -y bubblewrap'
+
+      - name: 'Set up Rust'
+        if: "matrix.sandbox == 'landlock'"
+        uses: 'actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606' # ratchet:actions-rust-lang/setup-rust-toolchain@v1
+        with:
+          toolchain: 'stable'
+
+      - name: 'Set up Landlock'
+        if: "matrix.sandbox == 'landlock'"
+        run: |
+          # Ensure securityfs is mounted
+          if [ ! -d /sys/kernel/security ]; then
+            sudo mount -t securityfs securityfs /sys/kernel/security
+          fi
+
+          # Diagnostics
+          echo "Kernel: $(uname -r)"
+          LSM_LIST=$(cat /sys/kernel/security/lsm 2>/dev/null || echo 'NOT AVAILABLE')
+          echo "LSMs: ${LSM_LIST}"
+
+          # Verify Landlock LSM is loaded
+          if ! echo "${LSM_LIST}" | grep -qw landlock; then
+            echo "::error::Landlock LSM is not available on this runner (kernel $(uname -r)). LSMs: ${LSM_LIST}"
+            exit 1
+          fi
+
+      - name: 'Install dependencies'
+        run: 'npm ci'
+
+      - name: 'Build project'
+        run: 'npm run build'
+
+      - name: 'Run sandbox unit tests'
+        run: |
+          npx vitest run \
+            packages/cli/src/utils/sandbox.test.ts \
+            packages/cli/src/utils/sandboxUtils.test.ts \
+            packages/cli/src/utils/bwrapProfiles.test.ts \
+            packages/cli/src/utils/bwrap-seccomp.test.ts \
+            packages/cli/src/utils/landlockProfiles.test.ts
+
+      - name: 'Run sandbox verification test'
+        env:
+          GEMINI_API_KEY: 'fake-key-for-sandbox-test'
+          KEEP_OUTPUT: 'true'
+          VERBOSE: 'true'
+          WSLENV: 'GEMINI_API_KEY:KEEP_OUTPUT:VERBOSE'
+        run: 'npm run test:integration:sandbox:${{ matrix.sandbox }} -- sandbox-verification.test.ts'
+
+      - name: 'Report sandbox metrics'
+        if: 'always()'
+        run: |
+          if [ -d .integration-tests ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+            find .integration-tests -name 'telemetry.log' -type f -print0 \
+              | xargs -0 node scripts/process-sandbox-metrics.js >> "${GITHUB_STEP_SUMMARY}"
+          fi
+
+  sandbox-summary:
+    name: 'Sandbox Tests Summary'
+    if: 'always()'
+    needs: 'test-sandbox'
+    runs-on: 'ubuntu-latest'
+    steps:
+      - name: 'Check results'
+        run: |
+          if [[ "${{ needs.test-sandbox.result }}" != "success" ]]; then
+            echo "One or more required sandbox tests failed."
+            exit 1
+          fi
+          echo "All required sandbox tests passed."
diff --git a/.gitignore b/.gitignore
@@ -51,6 +51,7 @@ packages/devtools/src/_client-assets.ts
 packages/vscode-ide-companion/*.vsix
 packages/cli/download-ripgrep*/
 
+
 # GHA credentials
 gha-creds-*.json