sandbox/seatbelt-aware system prompt, support for custom seatbelt profiles under project settings (#304)

packages/cli/src/utils/sandbox.ts

@@ -152,6 +152,21 @@ export async function start_sandbox(sandbox: string) {
       process.exit(1);
     }
     const profile = (process.env.SEATBELT_PROFILE ??= 'minimal');
+    let profileFile = new URL(`sandbox-macos-${profile}.sb`, import.meta.url)
+      .pathname;
+    // if profile is anything other than 'minimal' or 'strict', then look for the profile file under the project settings directory
+    if (profile !== 'minimal' && profile !== 'strict') {
+      profileFile = path.join(
+        SETTINGS_DIRECTORY_NAME,
+        `sandbox-macos-${profile}.sb`,
+      );
+    }
+    if (!fs.existsSync(profileFile)) {
+      console.error(
+        `ERROR: missing macos seatbelt profile file '${profileFile}'`,
+      );
+      process.exit(1);
+    }
     console.log(`using macos seatbelt (profile: ${profile}) ...`);
     // if DEBUG is set, convert to --inspect-brk in NODE_OPTIONS
     if (process.env.DEBUG) {
@@ -166,7 +181,7 @@ export async function start_sandbox(sandbox: string) {
       '-D',
       `HOME_DIR=${fs.realpathSync(os.homedir())}`,
       '-f',
-      new URL(`sandbox-macos-${profile}.sb`, import.meta.url).pathname,
+      profileFile,
       'bash',
       '-c',
       [

packages/server/src/core/prompts.ts

@@ -85,6 +85,25 @@ Rigorously adhere to existing project conventions when reading or modifying code
 -   **Help Command:** The user can use '/help' to display help information.
 -   **Feedback:** Direct feedback to ${contactEmail}.
 
+${(function () {
+  if (process.env.SANDBOX === 'sandbox-exec') {
+    return `
+# MacOS Seatbelt
+You are running under macos seatbelt with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. If you encounter failures that could be due to MacOS Seatbelt (e.g. if a command fails with 'Operation not permitted' or similar error), as you report the error to the user, also explain why you think it could be due to MacOS Seatbelt, and how the user may need to adjust their Seatbelt profile.
+`;
+  } else if (process.env.SANDBOX) {
+    return `
+# Sandbox
+You are running in a sandbox container with limited access to files outside the project directory or system temp directory, and with limited access to host system resources such as ports. If you encounter failures that could be due to sandboxing (e.g. if a command fails with 'Operation not permitted' or similar error), when you report the error to the user, also explain why you think it could be due to sandboxing, and how the user may need to adjust their sandbox configuration.
+`;
+  } else {
+    return `
+# Outside of Sandbox
+You are running outside of a sandbox container, directly on the user's system. For critical commands that are particularly likely to modify the user's system outside of the project directory or system temp directory, as you explain the command to the user (per the Explain Critical Commands rule above), also remind the user to consider enabling sandboxing.
+`;
+  }
+})()}
+
 # Examples (Illustrating Tone and Workflow)
 <example>
 user: 1 + 2