sandbox-lens

1import { atom, read, update } from 'claude-code'
2import type { EngineInterface, Register, Timer } from 'claude-code'
3
4import { fromStore, hasNew, isOverwritten, merge, parseDenials, union } from './parse'
5import type { Hit } from './parse'
6import { formatReport } from './report'
7
8const STORE_KEY = 'denials'
9const STATUS_MS = 8000
10
11const denials = atom({ plugin: 'sandbox-lens', key: 'denials' } as const, [])
12
13// $.store has no versioned write. Within this module, writes run one after another, each
14// reading the store afresh, so two Bash calls at once both land and a reset is not undone.
15let queue: Promise<unknown> = Promise.resolve()
16
17function serially<T>(work: () => Promise<T>): Promise<T> {
18  const run = queue.then(work)
19  queue = run.catch(() => undefined)
20  return run
21}
22
23/**
24 * Writes the merged tally, then reads it back: when another session wrote over it in
25 * between, the two are merged and written once more. Left over: a write from another
26 * session landing inside that second window, and two sessions counting the same denial
27 * at once, which reads as one sighting rather than two.
28 */
29function record($: EngineInterface, hits: readonly Hit[], command: string, now: number): Promise<void> {
30  return serially(async () => {
31    const wrote = merge(fromStore(await $.store.get(STORE_KEY)), hits, command, now)
32    await $.store.set(STORE_KEY, wrote)
33    const stored = fromStore(await $.store.get(STORE_KEY))
34    if (isOverwritten(wrote, stored)) await $.store.set(STORE_KEY, union(stored, wrote))
35  })
36}
37
38function forget($: EngineInterface): Promise<void> {
39  return serially(() => $.store.delete(STORE_KEY))
40}
41
42export const register: Register = on => {
43  let clearStatus: Timer | undefined
44
45  on('session.start', async ($, e, next) => {
46    await $.command.register({
47      name: 'sandbox-report',
48      description: 'sandbox の拒否（ネットワーク・ファイル）を集計して表示',
49      argumentHint: '[reset]',
50    })
51
52    return next(e)
53  })
54
55  // Observes only: a failure here must never change what the tool returned.
56  on('tool.call', { tool: 'Bash' }, async ($, e, next) => {
57    const ran = await next(e)
58    if (ran.deny !== undefined || ran.text === undefined) return ran
59
60    // A command that succeeded, or was interrupted, keeps its record: its own output in `stdout`
61    // and the harness's block alone in `stderr`, so a block in the output was printed by the
62    // command (`cat saved.log`), even at the end. One that failed keeps only its error text,
63    // and the block that ends it is read: there a printed block cannot be told apart.
64    const typed = ran.result
65    const stderr = typeof typed === 'object' && typed !== null ? (typed as { stderr?: unknown }).stderr : undefined
66    const hits = parseDenials(ran.text, e.command, await $.session.cwd(), typeof stderr === 'string' ? stderr : ran.text)
67    if (hits.length === 0) return ran
68
69    const now = await $.clock.now()
70    const before = await read($, denials)
71    const after = await update($, denials, list => merge(list, hits, e.command, now))
72    await record($, hits, e.command, now)
73
74    if (hasNew(before, hits)) {
75      $.ui.status(`sandbox 拒否 ${after.length} 種類（/sandbox-report で確認）`)
76      clearStatus?.cancel()
77      clearStatus = $.clock.after(STATUS_MS, () => $.ui.status(undefined))
78    }
79
80    return ran
81  }).catch(($, e, next) => next(e))
82
83  on('command.run', { command: 'sandbox-report' }, async ($, e) => {
84    if (e.args.trim() === 'reset') {
85      await forget($)
86      await update($, denials, () => [])
87      return { text: 'sandbox 拒否の記録を消去しました（このセッションと全期間）。' }
88    }
89
90    const session = await read($, denials)
91    const allTime = fromStore(await $.store.get(STORE_KEY))
92
93    return { text: formatReport(session, allTime) }
94  })
95}
96

1import type { SandboxLensDenial, SandboxLensKind } from '../types'
2
3export type Hit = { kind: SandboxLensKind; target: string }
4
5export const LIMIT = 200
6const EXAMPLE_CHARS = 80
7
8const OPEN = '<sandbox_violations>'
9const CLOSE = '</sandbox_violations>'
10const VIOLATION = /^\s*deny\s+(network-outbound|file-write[\w*-]*|file-read[\w*-]*)\s+(.+?)\s*$/
11
12// The tail a refusal line may carry after "permitted": Rust's `(os error 1)`.
13const TAIL = String.raw`(?:\s*\(os error 1\))?\s*$`
14
15// The shapes a program prints a refused path in, each `[program, path]`.
16const EPERM_LINES: RegExp[] = [
17  // ls: cannot open directory '/x/My Files': Operation not permitted
18  new RegExp(String.raw`^([\w./+-]+): (?:cannot|can't|could not|unable to|failed to) [^'"‘“]*?(['"‘“].+['"’”]): Operation not permitted${TAIL}`, 'i'),
19  // touch: /x/My Files/a.txt: Operation not permitted   ·   rg: /x: Operation not permitted (os error 1)
20  new RegExp(String.raw`^([\w./+-]+): (.+?): Operation not permitted${TAIL}`),
21  // zsh: operation not permitted: /x/a.txt
22  /^(zsh|bash|sh|fish): operation not permitted: (.+?)\s*$/i,
23  // PermissionError: [Errno 1] Operation not permitted: '/x/y'
24  /^(?:\w+\.)*(PermissionError|OSError): \[Errno 1\] Operation not permitted: (['"].+['"])\s*$/,
25]
26const EPERM_SHAPED = new RegExp(String.raw`Operation not permitted(?:${TAIL}|: )`, 'im')
27
28// Commands that print a file's content: a line there is the file's text unless it is the program's own message.
29const READERS = new Set(['cat', 'less', 'more', 'head', 'tail', 'grep', 'rg', 'ag', 'sed', 'awk', 'bat', 'jq', 'view', 'nl'])
30
31function kindOf(operation: string): SandboxLensKind {
32  if (operation === 'network-outbound') return 'network'
33  return operation.startsWith('file-write') ? 'file-write' : 'file-read'
34}
35
36const unquote = (text: string) => text.trim().replace(/^['"‘“]|['"’”]$/g, '')
37
38const baseName = (path: string) => path.split('/').pop() ?? ''
39
40function firstWord(command: string): string {
41  return baseName(command.trim().split(/\s+/)[0] ?? '')
42}
43
44/** A path made absolute against cwd, `.` and `..` folded. */
45export function absolute(path: string, cwd: string): string {
46  if (path.startsWith('/') || path.startsWith('~')) return path
47  const out: string[] = []
48  for (const part of `${cwd}/${path}`.split('/')) {
49    if (part === '' || part === '.') continue
50    if (part === '..') out.pop()
51    else out.push(part)
52  }
53  return `/${out.join('/')}`
54}
55
56/**
57 * The harness's own violations block: the one that ends the output, or the error text before
58 * the agent proxy's note. A block anywhere earlier was printed by the command (a file shown,
59 * a page fetched) and proves nothing.
60 */
61// What a proxied environment adds after the block of a failed command's error text.
62const PROXY_NOTE = '\n\n[agent-proxy] '
63
64function trailingBlock(output: string): string | undefined {
65  const note = output.lastIndexOf(PROXY_NOTE)
66  const text = (note < 0 ? output : output.slice(0, note)).trimEnd()
67  // Found from the end: a scan from each opening tag took quadratic time on many left unclosed.
68  if (!text.endsWith(CLOSE)) return undefined
69  const end = text.length - CLOSE.length
70  const start = text.lastIndexOf(OPEN, end)
71  return start < 0 ? undefined : text.slice(start + OPEN.length, end)
72}
73
74/**
75 * Denials named in one command's output, each (kind, target) once; relative paths resolved against cwd.
76 * `harness` is where the harness's block may be: the result's own `stderr` when the command
77 * succeeded (the engine keeps the command's output apart, in `stdout`), else the whole output.
78 */
79export function parseDenials(output: string, command = '', cwd = '', harness = output): Hit[] {
80  const seen = new Map<string, Hit>()
81  const add = (hit: Hit) => seen.set(`${hit.kind} ${hit.target}`, hit)
82
83  for (const line of (trailingBlock(harness) ?? '').split(/\r?\n/)) {
84    const match = VIOLATION.exec(line)
85    if (!match) continue
86    const [, operation = '', rest = ''] = match
87    const kind = kindOf(operation)
88    // A network denial is `host:port (why)`; a path runs to the end of the line, spaces and all.
89    const target = kind === 'network' ? (rest.split(/\s+/)[0] ?? rest) : unquote(rest.replace(/\s+\([^()]*\)$/, ''))
90    if (target !== '') add({ kind, target })
91  }
92  // The block already names the refusal the command's own stderr reports again.
93  if (seen.size > 0) return [...seen.values()]
94
95  const program = firstWord(command)
96  const isReader = READERS.has(program)
97  for (const line of output.split(/\r?\n/)) {
98    for (const shape of EPERM_LINES) {
99      const match = shape.exec(line)
100      if (!match) continue
101      const [, who = '', path = ''] = match
102      // What a reader prints is the file's text; only a line in its own name is its refusal.
103      if (isReader && baseName(who) !== program) break
104      const target = unquote(path)
105      if (target !== '' && !target.startsWith('(')) {
106        add({ kind: 'eperm', target: cwd === '' ? target : absolute(target, cwd) })
107      }
108      break
109    }
110  }
111  if (seen.size === 0 && !isReader && EPERM_SHAPED.test(output)) {
112    add({ kind: 'eperm', target: '(path unknown)' })
113  }
114
115  return [...seen.values()]
116}
117
118// Name segments that mark a value as a credential (`ANTHROPIC_API_KEY`, `x-access-token`, `db_pass`).
119const SECRET_WORDS = new Set([
120  'key', 'apikey', 'token', 'secret', 'password', 'passwd', 'pass', 'pwd',
121  'auth', 'cookie', 'session', 'credential', 'credentials',
122])
123// Words that mark a credential even inside a camelCase name (`accessToken`, `clientSecret`, `APIKey`),
124// and endings that mark one run together (`PGPASSWORD`). `key` and `session` are left out here:
125// `primaryKey` and `sessionId` are ids, not credentials.
126const STRONG_WORDS = new Set(['apikey', 'token', 'secret', 'password', 'passwd', 'credential', 'credentials'])
127const SECRET_ENDINGS = ['password', 'passwd', 'token', 'secret', 'apikey']
128const isStrongName = (name: string) =>
129  name.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase().split(/[_-]/).some(part => STRONG_WORDS.has(part)) ||
130  SECRET_ENDINGS.some(end => name.toLowerCase().replace(/[_-]/g, '').endsWith(end))
131const isSecretName = (name: string) => name.toLowerCase().split(/[_-]/).some(part => SECRET_WORDS.has(part)) || isStrongName(name)
132
133// A value: quoted whole, or up to whitespace or a shell separator.
134const VALUE = String.raw`(?:"[^"]*"|'[^']*'|[^\s&;|'"]+)`
135
136type Replacer = (substring: string, ...groups: string[]) => string
137type Mask = [RegExp, string | Replacer]
138
139// NAME=value. The name is bounded so a long run such as `a-a-a-…` is scanned in linear time, not once per hyphen.
140const NAME_VALUE = new RegExp(String.raw`\b([A-Za-z][\w-]{0,127})=(${VALUE})`, 'g')
141const maskName: Replacer = (whole, name = '') => (isSecretName(name) ? `${name}=***` : whole)
142// One level into the value, not recursively: `a=a=a=…` must not grow the stack.
143const maskNameValue: Replacer = (whole, name = '', value = '') =>
144  isSecretName(name) ? `${name}=***` : value.includes('=') ? `${name}=${value.replace(NAME_VALUE, maskName)}` : whole
145
146// Credentials a command line may carry, each kept to its name.
147const SECRETS: Mask[] = [
148  // URL userinfo: user:password@ keeps the user, a token alone@ goes whole; host and path stay.
149  // The scheme is bounded, as the NAME=value name below is, to keep a long hyphenated run linear.
150  [/(\b[a-z][\w+.-]{0,31}:\/\/)([^/\s:@'"]+):([^/\s@'"]+)@/gi, '$1$2:***@'],
151  [/(\b[a-z][\w+.-]{0,31}:\/\/)([^/\s:@'"*]+)@/gi, '$1***@'],
152  // Headers: Authorization keeps its scheme, Cookie loses every pair.
153  [/(authorization:\s*)(?:(bearer|basic|token)\s+)?[^\s'"]+/gi, (_, head = '', scheme = '') => `${head}${scheme ? `${scheme} ` : ''}***`],
154  [/(\bcookie:\s*)[^\s'";]+(?:;\s*[^\s'";]+)*;?/gi, '$1***'],
155  [/\b(bearer)\s+(?!\*\*\*)[\w.~+/=-]+/gi, '$1 ***'],
156  // Any other header a request sends whose name reads as a credential (-H "X-API-Key: x"); only
157  // as -H/--header, so an error line such as `Unexpected token: '<'` is left as it is. A quoted
158  // value goes whole up to its closing quote (`X-Auth: Token abc`); an unquoted header is one shell
159  // word with no space after the colon, so `grep -H password: config.yml` keeps its file name.
160  [
161    /((?:^|\s)(?:-H|--header)(?:=|\s*))(?:(["'])([\w-]+)(:\s*)(?:(?!\2)[^\n])+|([\w-]+)(:)[^\s'"]+)/g,
162    (whole, head = '', quote = '', quotedName = '', quotedColon = '', name = '', colon = '') => {
163      if (quote !== '') return isSecretName(quotedName) ? `${head}${quote}${quotedName}${quotedColon}***` : whole
164      return isSecretName(name) ? `${head}${name}${colon}***` : whole
165    },
166  ],
167  // -u user:pass, -uuser:pass, --user=user:pass, -u "user:pass"
168  [/(\s(?:-u|--user)(?:=|\s+)?)(["']?)([^\s:'"]+):([^\s'"]+)/g, '$1$2$3:***'],
169  // --password x, --token=x, --client-secret "x"
170  [
171    new RegExp(String.raw`(--(?:client-secret|api-?key|secret|token|auth-token|access-token|password|passwd)(?:=|\s+))${VALUE}`, 'gi'),
172    '$1***',
173  ],
174  // NAME=value where the name reads as a credential, quoted values too (env assignments, query strings).
175  // A value that is itself NAME=value (kubectl --from-literal=password=x) is looked into.
176  [NAME_VALUE, maskNameValue],
177  // "name": "value" (JSON in an output line) where the name reads as a credential.
178  // A bare "key" or "session" is an id there (a path, an S3 key), not a credential.
179  [/("([\w-]+)"\s*:\s*)"[^"]*"/g, (whole, head = '', name = '') => (isSecretName(name) && !/^(?:key|session)$/i.test(name) ? `${head}"***"` : whole)],
180  // Bare tokens with a known shape.
181  [/\b(sk-(?:ant-)?)[\w-]{16,}/g, '$1***'],
182  [/\b(gh[pousr]_)[A-Za-z0-9]{10,}/g, '$1***'],
183  [/\b(github_pat_)\w{10,}/g, '$1***'],
184  [/\b(xox[abprs]-)[\w-]{8,}/g, '$1***'],
185  [/\bAKIA[0-9A-Z]{16}\b/g, 'AKIA***'],
186  [/\b(glpat-)[\w-]{20,}/g, '$1***'],
187  [/\b(npm_)[A-Za-z0-9]{36}\b/g, '$1***'],
188  [/\b((?:sk|rk)_(?:live|test)_)[A-Za-z0-9]{10,}/g, '$1***'],
189  [/\bAIza[\w-]{35}\b/g, 'AIza***'],
190  // Started only where no word or hyphen comes before, so `eyJ-eyJ-…` is not rescanned from each one.
191  [/(?<![\w-])eyJ[\w-]{8,}\.eyJ[\w-]{8,}\.[\w-]*/g, 'eyJ***'],
192]
193
194// Programs whose -p takes a password: attached (mysql -pX) or as the next word (sshpass -p X, docker login -p X).
195const ATTACHED_P = /\b(?:mysql|mariadb|mysqldump|mysqladmin)\b/
196// The words before `login` are bounded, so a long run of `docker docker …` stays linear.
197const SPACED_P = /\bsshpass\b|\b(?:docker|podman|nerdctl|helm)\b(?:\s+\S+){0,8}?\s+login\b/
198
199/** The command as an example: credentials masked, cut to a line. */
200export function exampleOf(command: string): string {
201  let masked = SECRETS.reduce((text, [pattern, mask]) => text.replace(pattern, mask as Replacer), command)
202  if (ATTACHED_P.test(masked)) masked = masked.replace(/(\s-p)(?!\s)\S+/g, '$1***')
203  if (SPACED_P.test(masked)) masked = masked.replace(/(\s-p\s+)\S+/g, '$1***')
204  masked = masked.replace(/ {2,}/g, ' ')
205  return masked.length > EXAMPLE_CHARS ? `${masked.slice(0, EXAMPLE_CHARS)}…` : masked
206}
207
208const keyOf = (one: { kind: string; target: string }) => `${one.kind} ${one.target}`
209
210/** Adds one command's hits to a tally; past LIMIT the least recently seen leave, so a new one always stays. */
211export function merge(
212  list: readonly SandboxLensDenial[],
213  hits: readonly Hit[],
214  command: string,
215  now: number,
216): SandboxLensDenial[] {
217  const example = exampleOf(command)
218  const next = list.map(one => ({ ...one }))
219  // Found by key, not by a search of the list: `find ~` may be refused at thousands of paths.
220  const byKey = new Map(next.map(one => [keyOf(one), one]))
221
222  for (const hit of hits) {
223    const found = byKey.get(keyOf(hit))
224    if (found) {
225      found.count += 1
226      found.lastSeen = now
227      found.example = example
228    } else {
229      const added = { ...hit, count: 1, lastSeen: now, example }
230      next.push(added)
231      byKey.set(keyOf(added), added)
232    }
233  }
234
235  return capped(next)
236}
237
238function capped(list: SandboxLensDenial[]): SandboxLensDenial[] {
239  return ranked([...list].sort((a, b) => b.lastSeen - a.lastSeen).slice(0, LIMIT))
240}
241
242/**
243 * Two tallies as one: each (kind, target) once, the larger count and the later sighting
244 * (with that sighting's example). Used when another session wrote the store in between.
245 */
246export function union(a: readonly SandboxLensDenial[], b: readonly SandboxLensDenial[]): SandboxLensDenial[] {
247  const byKey = new Map<string, SandboxLensDenial>()
248  for (const one of [...a, ...b]) {
249    const key = `${one.kind} ${one.target}`
250    const had = byKey.get(key)
251    if (had === undefined) {
252      byKey.set(key, { ...one })
253      continue
254    }
255    const later = one.lastSeen > had.lastSeen ? one : had
256    byKey.set(key, { ...later, count: Math.max(had.count, one.count), lastSeen: Math.max(had.lastSeen, one.lastSeen) })
257  }
258  return capped([...byKey.values()])
259}
260
261/** True when `stored` lacks an entry of `wrote`, or holds it with a smaller count: another session wrote over it. */
262export function isOverwritten(wrote: readonly SandboxLensDenial[], stored: readonly SandboxLensDenial[]): boolean {
263  return wrote.some(one => {
264    const found = stored.find(other => other.kind === one.kind && other.target === one.target)
265    return found === undefined || found.count < one.count
266  })
267}
268
269/** True when a hit names a (kind, target) the list does not hold yet. */
270export function hasNew(list: readonly SandboxLensDenial[], hits: readonly Hit[]): boolean {
271  const known = new Set(list.map(keyOf))
272  return hits.some(hit => !known.has(keyOf(hit)))
273}
274
275export function ranked(list: readonly SandboxLensDenial[]): SandboxLensDenial[] {
276  return [...list].sort((a, b) => b.count - a.count || b.lastSeen - a.lastSeen)
277}
278
279/** Reads what $.store holds, dropping anything that is not a denial. */
280export function fromStore(value: unknown): SandboxLensDenial[] {
281  if (!Array.isArray(value)) return []
282  return value.filter(
283    (one): one is SandboxLensDenial =>
284      typeof one === 'object' &&
285      one !== null &&
286      typeof one.kind === 'string' &&
287      typeof one.target === 'string' &&
288      typeof one.count === 'number',
289  )
290}
291

1import type { SandboxLensDenial, SandboxLensKind } from '../types'
2
3import { ranked } from './parse'
4
5const SHOWN = 10
6
7const LABEL: Record<SandboxLensKind, string> = {
8  network: 'ネットワーク',
9  'file-write': '書き込み',
10  'file-read': '読み取り',
11  eperm: 'EPERM',
12}
13
14export function hostOf(target: string): string {
15  const bracketed = /^\[([^\]]+)\](?::\d+)?$/.exec(target)
16  if (bracketed) return bracketed[1] ?? target
17  // A bare IPv6 address (`::1`, `fe80::1`) has no port that can be told from its last group.
18  if ((target.match(/:/g) ?? []).length > 1) return target
19  return target.replace(/:\d+$/, '')
20}
21
22/** Loopback and private addresses: their allowedDomains entry opens every port unless it names one. */
23export function isLocalHost(host: string): boolean {
24  const name = host.toLowerCase()
25  if (name === 'localhost' || name.endsWith('.localhost') || name.endsWith('.local')) return true
26  if (name === '::1' || name === '::' || name === '0.0.0.0') return true
27  // An IPv4 address written as IPv6 (`::ffff:127.0.0.1`) is as local as the address it carries.
28  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(name)
29  if (mapped) return isLocalHost(mapped[1] ?? '')
30  if (name.includes(':')) return /^(fe[89ab][0-9a-f]:|f[cd][0-9a-f]{2}:)/.test(name) // link-local, unique-local
31  const octets = name.split('.').map(Number)
32  if (octets.length !== 4 || octets.some(n => !Number.isInteger(n) || n < 0 || n > 255)) return false
33  const [a = -1, b = -1] = octets
34  return (
35    a === 127 ||
36    a === 10 ||
37    (a === 192 && b === 168) ||
38    (a === 172 && b >= 16 && b <= 31) ||
39    (a === 169 && b === 254) ||
40    (a === 100 && b >= 64 && b <= 127) // shared address space (CGNAT, Tailscale)
41  )
42}
43
44/** The allowedDomains entry to suggest: a local address keeps its port, so the hint never opens every port. */
45export function networkEntry(target: string): string {
46  return isLocalHost(hostOf(target)) ? target : hostOf(target)
47}
48
49/** Which setting would allow a denial: a hint for the person, never applied. */
50export function hintFor(denial: SandboxLensDenial): string {
51  switch (denial.kind) {
52    case 'network':
53      return `sandbox.network.allowedDomains に "${networkEntry(denial.target)}"`
54    case 'file-write':
55      return `sandbox.filesystem.allowWrite に "${denial.target}"`
56    case 'file-read':
57      return `sandbox.filesystem.allowRead に "${denial.target}"（denyRead に含まれていないか確認）`
58    case 'eperm':
59      return denial.target.startsWith('(')
60        ? 'パス不明: 該当コマンドを --debug で再確認'
61        : `書き込みなら sandbox.filesystem.allowWrite に "${denial.target}"`
62  }
63}
64
65function clock(ms: number): string {
66  const at = new Date(ms)
67  const pad = (n: number) => String(n).padStart(2, '0')
68  return `${at.getMonth() + 1}/${at.getDate()} ${pad(at.getHours())}:${pad(at.getMinutes())}`
69}
70
71function section(title: string, list: readonly SandboxLensDenial[]): string {
72  if (list.length === 0) return `■ ${title}\n  拒否なし`
73
74  const total = list.reduce((sum, one) => sum + one.count, 0)
75  const rows = ranked(list)
76    .slice(0, SHOWN)
77    .map(
78      one =>
79        `  ${LABEL[one.kind]}  ${one.target}  ×${one.count}  (最終 ${clock(one.lastSeen)})\n` +
80        `    例: ${one.example}\n` +
81        `    ヒント: ${hintFor(one)}`,
82    )
83  const rest = list.length > SHOWN ? [`  …ほか ${list.length - SHOWN} 件`] : []
84
85  return [`■ ${title}（${list.length} 種類 / 計 ${total} 回）`, ...rows, ...rest].join('\n')
86}
87
88export function formatReport(
89  session: readonly SandboxLensDenial[],
90  allTime: readonly SandboxLensDenial[],
91): string {
92  return [
93    'sandbox 拒否レポート',
94    section('このセッション', session),
95    section('全期間', allTime),
96    '設定は変更していません。ヒントは許可する場合の候補です。',
97  ].join('\n\n')
98}
99

1export type SandboxLensKind = 'network' | 'file-write' | 'file-read' | 'eperm'
2
3export type SandboxLensDenial = {
4  kind: SandboxLensKind
5  target: string
6  count: number
7  lastSeen: number
8  example: string
9}
10
11declare module 'claude-code' {
12  interface PluginState {
13    'sandbox-lens': { denials: SandboxLensDenial[] }
14  }
15}
16