internal/

agent-sandbox/internal/claude/contextmode.go

Package envflag loads environment variables from --env references and applies them to the current process.

Package execd carries command execution across the sandbox boundary.

Package policysnapshot used to persist the sandbox policy to a per-session JSON file so hook-mode `agent-sandbox exec` could route from a frozen copy the agent could not edit.

Package shellquote quotes strings as single shell tokens.